Security audit

Ask a Chargeback Nerd

Security checks across malware telemetry and agentic risk

Overview

This is a Markdown-only chargeback guidance skill with no hidden code or account access, but users should verify financial advice with their issuer.

Install only if you want help preparing consumer chargeback or payment-dispute materials. Treat deadlines, reason codes, and provisional-credit statements as guidance to verify with your bank, card issuer, or payment platform, and keep highly sensitive account credentials out of chat.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger instructions are intentionally expansive and explicitly say to invoke the skill even when a user merely says they were charged for something they did not get. That can cause the agent to route ordinary refund, billing-help, or general advice requests into a chargeback workflow, which is risky because chargebacks are a formal financial dispute mechanism and misrouting can lead to inappropriate guidance or escalation.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The statement that a cardholder is 'entitled' to provisional credit is overbroad and can misstate Visa policy or issuer obligations. In a chargeback-assistance skill, users may rely on this as authoritative guidance, leading them to make inaccurate demands to their bank or misunderstand their rights during a dispute.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.