Screenshots

• Outcome: Pass
• Latest audit: May 28, 2026, 12:56 PM
• Version:
  1.0.1

Overview

This screenshot-generation skill is coherent and purpose-aligned, with a privacy caveat because it stores reusable local preferences and feedback.

Install only if you are comfortable with a ~/screenshots workspace that can remember style preferences and project feedback across future screenshot tasks. Avoid storing secrets or private customer data in raw screenshots or feedback, use simple path-safe app names, and periodically delete or edit ~/screenshots/memory.md and ~/screenshots/learnings.md when preferences should not carry over.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill says to 'Read on activation' but never defines what activation means, which can cause the agent to access persistent local data outside clear user intent. In a skill that stores cross-session preferences, ambiguous activation increases the chance of unexpected data access and privacy violations, even if no obviously malicious behavior is described.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly stores user preferences in ~/screenshots/memory.md across sessions but does not clearly disclose that local persistence will occur or what data will be retained. This creates a privacy and consent issue because users may unknowingly leave branding, style preferences, app-related information, or workflow history on disk for later reuse.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs persistent storage of per-user preferences, dislikes, and even verbatim feedback in a user-specific file, but provides no limits on what may be stored, no retention rules, and no privacy notice or consent guidance. This creates a real privacy/security risk because sensitive personal data can accumulate over time and later be exposed, reused beyond the original purpose, or handled in ways the user did not expect.

VirusTotal

66/66 vendors flagged this skill as clean.