The Bully Pulpit

• Outcome: Pass
• Latest audit: Jun 12, 2026 at 11:48 AM UTC
• Version:
  1.0.0

Overview

This appears to be a book/history skill with overly broad activation wording, but no evidence of harmful access, persistence, credential use, or unsafe behavior.

Before installing, be aware that the skill may activate for broad history or politics queries when you did not specifically ask for this book-focused assistant. Use explicit prompts when you want it, and disable or edit broad triggers if they interrupt unrelated work.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger list is excessively broad and includes many generic historical and political terms, which can cause the skill to activate for queries not actually requesting this book-specific behavior. Over-broad activation can hijack unrelated conversations, degrade routing integrity, and increase the chance that users receive off-target guidance instead of the assistant’s normal handling.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The onboarding trigger activates when a user says they 'just installed this skill' or 'don't know how to start,' which is not specific to the domain and may capture generic help-seeking messages. This creates unintended invocation risk, especially in contexts where the user wants general onboarding rather than a history/politics skill, leading to confusion and conversation takeover.

VirusTotal

64/64 vendors flagged this skill as clean.