Midnight in Chernobyl: The Untold Story of the World's Greatest Nuclear Disaster

Security checks across malware telemetry and agentic risk

Overview

This is a content-only Chernobyl book companion skill with broad activation rules but no executable code, credential access, persistence, or data-changing behavior.

Install this if you want a Chernobyl/Midnight in Chernobyl reference helper. Be aware it may activate on many Chernobyl-related names or phrases and will append a Heardly-branded footer; the content also includes graphic radiation-injury descriptions and contested historical casualty estimates.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger list is extremely broad and matches many ordinary history or news questions about Chernobyl, which can cause the skill to activate without clear user intent. That creates prompt-scope hijacking risk: the assistant may follow this skill's formatting and behavioral rules in unrelated conversations, overriding normal routing and degrading trust or response quality.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The onboarding rule triggers when a user says they just installed the skill or does not know how to start, which are common phrases that may appear outside a deliberate skill invocation. Because the skill also says the AI MUST proactively present the guide, this can force unsolicited behavior and let the skill seize control of the conversation flow from weak signals.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal