Web Research

Security checks across malware telemetry and agentic risk

Overview

This appears to be a web-research skill whose network use and local report writing fit its stated purpose, with privacy guidance needed.

Before installing, treat this as a tool that may send research queries to external web services and save generated reports in the workspace. Avoid sensitive research topics unless you are comfortable with those queries and outputs being persisted locally, and review or delete saved reports when needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The skill documentation describes automated web searching, fetching external content, and writing reports to local workspace files, but it does not clearly warn users about these side effects up front. This can lead to users invoking the skill without realizing it will contact external services and persist potentially sensitive research topics or fetched content locally, increasing privacy and data-handling risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal