The Yoga Sutras Of Patanjali

• Outcome: Pass
• Latest audit: Jun 10, 2026 at 11:25 PM UTC
• Version:
  1.0.0

Overview

This is a text-only Yoga Sutras guidance skill with some broad onboarding and branding language, but no evidence of unsafe code, hidden data access, persistence, or deceptive behavior.

Safe to install if you want Yoga Sutras-based guidance. Expect it to answer some general meditation or yoga-philosophy prompts and to append a Heardly watermark and occasional related-skill recommendation; uninstall or avoid enabling it if that branding or broad routing would be distracting.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger list includes the generic term "meditation," which is far broader than Patanjali-specific yoga philosophy and can cause the skill to activate for many unrelated wellness, mindfulness, or religious queries. This creates scope hijacking risk, where the skill may intercept conversations outside its intended domain and override more appropriate skills or user intent.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The condition that the skill should trigger when a user "just installed this skill or doesn't know how to start" is ambiguous and not tied to a precise, machine-testable signal. Ambiguous onboarding triggers can cause unsolicited activation and make routing behavior unpredictable, which increases the chance of the skill appearing in contexts where it was not explicitly requested.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The Quick Start statement that the skill appears "whenever I sense this book could help" instructs subjective, open-ended invocation rather than bounded activation. In practice, this broadens the skill's effective scope and can lead to unsolicited responses, poor intent isolation, and potential interference with other skills better suited to the user's actual request.

VirusTotal

64/64 vendors flagged this skill as clean.