File Organizer

• Outcome: Review
• Latest audit: May 29, 2026, 9:34 PM
• Version:
  1.0.0

Overview

This skill is a coherent file organizer, but it can move and rename local files immediately and has weak safeguards around broad user directories.

Review carefully before installing. Use it first on a small test folder with --dry-run, avoid important or synced directories until you verify behavior, and keep backups because undo relies on the local log and the tool can change filenames and file locations immediately.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README clearly promotes automatic sorting, renaming, and moving of user files, but it does not prominently warn that these operations can change file locations and filenames in ways that may disrupt workflows or make data harder to find if misused. Because this is a file-management skill operating on user directories like Downloads, insufficient warning and consent language increases the risk of unintended data modification even if the feature is legitimate.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill exposes very broad natural-language invocation phrases such as "Organize my Downloads folder" and "Organize ~/Documents/projects" without any clear activation boundaries, confirmation requirements, or scoped safeguards. In an agent environment, this can lead to unintended triggering of bulk file operations on sensitive directories, causing accidental mass moves/renames and workflow disruption even if the skill is not overtly malicious.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The configuration enables automatic sorting of files as soon as the skill runs, but it does not define any activation constraints, confirmation requirement, or limited execution scope. Because the source directory is a broad user-controlled location (~/Downloads), this can cause unintended bulk file moves or renames, increasing the risk of data disruption or loss of expected file locations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script moves files out of source directories immediately when run without any explicit confirmation prompt or safety interlock beyond an optional dry-run flag. In an agent or automation context, this can cause unintended bulk file modifications or data disruption if the command is invoked with the wrong source, target, or config, especially because the default behavior targets user Downloads and performs real moves.

VirusTotal

67/67 vendors flagged this skill as clean.