3d Filament Tracker

Security checks across malware telemetry and agentic risk

Overview

This skill is a local 3D-printing filament inventory helper with disclosed screenshot reading and local HTML/browser-state storage, and I found no evidence of exfiltration or unsafe automatic behavior.

Install only if you are comfortable letting the agent inspect relevant 3D-filament order screenshots and save a local tracker folder. Avoid giving unrelated shopping screenshots, review the Markdown extraction table before generation, and delete the generated HTML, copied screenshots, localStorage state, or exported JSON when you no longer need them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill can activate on very broad, natural-language requests plus the mere presence of screenshot uploads, which increases the chance of unintended invocation on unrelated shopping or image-analysis tasks. In a multimodal agent, this can cause over-collection and processing of user screenshots containing sensitive order, address, or payment metadata beyond the user’s actual intent.

Vague Triggers

Low

Confidence: 88% confidence
Finding: The trigger section provides positive activation examples but no clear boundaries for when the skill should not run, making scope ambiguous. This increases the risk of the skill being selected for loosely related screenshot-review requests, leading to unnecessary data handling and user confusion rather than a direct code-execution issue.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal