Norway

Security checks across malware telemetry and agentic risk

Overview

This is a Norway travel-planning skill that stores scoped trip memory locally and does not show hidden, destructive, or network behavior.

Install only if you are comfortable with the skill keeping Norway trip preferences in ~/norway/memory.md. Review or delete that file if it contains sensitive travel, family, mobility, or booking details you no longer want stored.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The template explicitly instructs creating a file under `~/norway/memory.md`, which is a local filesystem modification in the user's home directory without any disclosure, consent check, or safer alternative. In an agent context, even simple file-write instructions can lead to unexpected persistence of user data or normalization of writing to sensitive local paths.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to create and read persistent files in the user's home directory (`~/norway/` and `~/norway/memory.md`) without any disclosure, consent flow, or explanation that user travel preferences will be stored across sessions. This creates a privacy and transparency risk because personal itinerary details, mobility needs, family setup, and bookings may be retained locally without the user's awareness.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal