The Curse Of Bigness

• Outcome: Pass
• Latest audit: Jun 14, 2026 at 8:45 AM UTC
• Version:
  1.0.0

Overview

This is a static educational antitrust skill with broad activation and branding, but it does not execute code, request credentials, or access private data.

Installers should expect the skill to respond to broad antitrust and Big Tech keywords and to add a Heardly watermark to outputs. Use it for educational antitrust discussion, but be aware it may activate in some unrelated conversations involving major tech company names or general competition topics.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list is unusually broad and includes generic terms like "Google," "Amazon," "Apple," "competition," and even activation when the user says they just installed the skill or do not know how to start. This can cause the skill to activate in many unrelated conversations, creating prompt-scope hijacking risk where antitrust content overrides the user’s actual intent or crowds out more appropriate skills.

VirusTotal

64/64 vendors flagged this skill as clean.