Make It Stick

• Outcome: Pass
• Latest audit: Jun 4, 2026 at 8:38 PM UTC
• Version:
  1.0.1

Overview

This is a low-risk study-coaching skill with broad activation and promotional onboarding, but no code execution, credential access, file access, or persistence.

Install this if you want proactive study-method coaching. Expect it to activate on common studying or exam-prep questions, show onboarding when loaded, and append Heardly branding; avoid it if you prefer narrow, opt-in skills only.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are broad, generic study-help utterances that many normal conversations could match, increasing the chance the skill is invoked when the user did not intend to use this specific skill. In this file, that risk is amplified because the skill also instructs the AI to proactively present content on first load, so accidental activation can lead to unsolicited steering and response shaping.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Stating that the skill 'also triggers on install' without clear limits or user-consent conditions creates a risk of unsolicited execution and automatic content injection into the user experience. Combined with the Quick Start requirement that the AI 'MUST proactively present this guide,' installation can become an implicit auto-run path that bypasses normal user intent checks.

VirusTotal

56/56 vendors flagged this skill as clean.