Security audit
A/B Testing Tool Skill
Security checks across malware telemetry and agentic risk
Overview
This is mostly a simple local A/B testing tool, but it needs review because crafted test names can make it read or overwrite JSON files outside its own test folder.
Review before installing if other people or automation may pass test names into this tool. Use only trusted, simple test names, avoid storing sensitive customer analytics unless you have proper privacy controls, and prefer a fixed version that validates names or ensures resolved paths stay inside the intended tests directory.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
63/63 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.