Call Center

• Outcome: Review
• Latest audit: May 28, 2026, 4:50 AM
• Version:
  1.0.0

Overview

This call-center skill is aligned with customer support work, but it encourages storing caller and escalation details locally without clear privacy, retention, or access-control limits.

Review before installing in any real customer-support environment. Use it only with approved ticketing or CRM systems, avoid storing raw sensitive data in local files, define retention and deletion rules, and add explicit instructions for redacting payment data, credentials, government IDs, health data, and legal/compliance details.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill directs persistent storage of call memory, escalation logs, metrics, and CRM updates, but provides no explicit privacy notice, consent requirements, data minimization rules, or retention limits. In a call-center context, this can lead to collection and persistence of personal or sensitive customer information without adequate safeguards, increasing compliance, privacy, and data exposure risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The guide directs agents to record caller contact details, issue summaries, and emotional state, but provides no constraints on data minimization, access control, retention, or handling of sensitive information. In a call-center context, this can lead to over-collection or improper storage of personal data, increasing privacy, compliance, and insider-misuse risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The template explicitly instructs storage of caller names, issue details, follow-ups, and caller preferences, which can include personal or sensitive customer information, but provides no guidance on data minimization, access control, retention, or avoiding secrets and regulated data. In a call-center context, this materially increases the chance that operators will persist unnecessary customer data in plaintext local files, creating privacy, compliance, and insider-access risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The escalation log captures caller, issue, status, and legal/compliance-related matters, but omits any warning that these records may contain sensitive personal, account, dispute, or regulated information. Because escalation records often involve higher-risk incidents, the absence of safeguards encourages logging sensitive details in plaintext and broadening access beyond need-to-know personnel.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The verification script instructs agents to collect account-related identifiers such as account number, email, or the last 4 digits of a phone number, but it provides no guidance on collecting only the minimum necessary information, confirming authorization, or explaining privacy handling. In a call-center context, this can normalize oversharing of personal data, increase exposure of customer information during social-engineering attempts, and create inconsistent identity-verification practices.

VirusTotal

62/62 vendors flagged this skill as clean.