Strategy

Security checks across malware telemetry and agentic risk

Overview

This is a strategy-advice skill with clearly disclosed local memory, not hidden code or network behavior.

Safe to install for strategy coaching. Before using the memory feature, decide whether you are comfortable storing business or personal strategy context in ~/strategy/memory.md, avoid secrets and highly confidential details, and periodically review or delete that folder when the retained context is no longer wanted.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly states that user context persists in `~/strategy/memory.md`, which means potentially sensitive preferences, constraints, past decisions, or business context may be stored across sessions. Even though this appears intended to improve functionality rather than harm users, the lack of disclosure, consent, retention limits, and handling guidance creates a real privacy and data minimization risk if sensitive information is written to disk unexpectedly.

Missing User Warnings

Low

Confidence: 95% confidence
Finding: The skill explicitly instructs creation of persistent files under the user's home directory, which causes local data retention without any disclosure, consent flow, or retention guidance. In a strategy skill, those files are likely to store sensitive business and operational information, so even though the behavior is straightforward, it creates a privacy and data-handling risk.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal