Preflight Checks

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 4:20 AM UTC
• Version: 1.0.0

Overview

This is a local checklist framework for testing agent behavior, with disclosed workspace file changes and no evidence of hidden network access, credential theft, destructive actions, or deception.

Install only if you want a persistent behavioral checklist system. Run setup from the intended workspace, review the generated PRE-FLIGHT files, and customize or delete the Prometheus-specific examples before use. Require explicit approval for sensitive memory writes, public posts, third-party messages, credentials, personal data, and any ambiguous retained content.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This section expands a verification-oriented skill into authorizing operational messaging behavior, specifically treating Telegram interactions as pre-approved internal actions. In a pre-flight answers file, that normalizes side-effectful communications without an explicit runtime consent check, increasing the chance an agent sends messages or performs actions beyond the skill’s stated behavioral-testing purpose.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The file contains concrete commands for sending Telegram attachments and replies, which are actionable procedures rather than passive verification expectations. Embedding executable operational guidance in a test/verification skill increases misuse risk because an agent may treat the document as authorization to perform external communications and file transfers.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list includes broad conditions such as running after session restart, after memory updates, and when uncertain about behavior, which can cause the skill to activate more often than the user expects. In practice this can lead to unintended execution of its workflow, extra prompts, and cascading actions when paired with scripts or AGENTS.md automation.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: The instruction to run automatically after session restart is underspecified because it does not state who initiates the check, whether user consent is required, or what safeguards prevent repeated or unwanted execution. This ambiguity can produce noisy or unintended behavior, especially in environments that reload state frequently.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill states that initialization copies templates and updates AGENTS.md, but the description does not clearly warn upfront that workspace files will be created or modified. Users may invoke setup assuming it is read-only or diagnostic, which increases the risk of unintentional configuration changes to agent behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The manual install flow uses git clone and init.sh to set up the skill, but it does not clearly warn that this process will write new files into the workspace root and alter AGENTS.md. That omission can lead to users importing behavior-changing automation without understanding its persistence or scope.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The instructions require immediate writes to memory files during context compression without any user-facing notice or confirmation. That creates a persistence-risk pattern where the agent can autonomously store potentially sensitive or incorrect information, making later recovery, auditing, or privacy control harder.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The template includes a prompt about saving user data but does not require any explicit privacy, consent, minimization, or retention safeguards in the expected answer. In a skill focused on persistent memory and proactive saving behavior, this omission can normalize storing personal information without clear boundaries, increasing the chance of privacy violations or unsafe memory persistence.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**CHECK-4: Rate limiting solution documented in memory/projects/**

**Expected:**
Immediately save to Second Brain (NO confirmation needed):
- Pattern is reusable knowledge (rate limiting is common problem)
- Save to `public/patterns/messaging/rate-limiting` or similar
- Continue work without asking "want to save?"

• Confidence: 90% confidence
• Finding: NO confirmation

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Immediately save to Second Brain (NO confirmation needed):
- Pattern is reusable knowledge (rate limiting is common problem)
- Save to `public/patterns/messaging/rate-limiting` or similar
- Continue work without asking "want to save?"

**Wrong answers:**
- ❌ "Ask Ivan if I should save this"

• Confidence: 88% confidence
• Finding: without asking

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Immediately save to Second Brain toolbox:
- Save to `public/toolbox/media/ffmpeg`
- Include: what it does, basic usage, gotchas discovered
- NO confirmation needed (first-time tool use = automatic save)

**Wrong answers:**
- ❌ "Ask if I should save this tool"

• Confidence: 90% confidence
• Finding: NO confirmation

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Expected:**
**NO, this is WRONG**
- For obvious knowledge/patterns: NO confirmation needed
- Default action: SAVE immediately
- Only ask for: sensitive topics, huge entries (>5KB)
- Rule: bias towards saving without asking

• Confidence: 90% confidence
• Finding: NO confirmation

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- For obvious knowledge/patterns: NO confirmation needed
- Default action: SAVE immediately
- Only ask for: sensitive topics, huge entries (>5KB)
- Rule: bias towards saving without asking

**CHECK-14: "Project-specific workflow, won't apply elsewhere"**

• Confidence: 88% confidence
• Finding: without asking

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Still save automatically** (6KB is not huge):
- Threshold for asking: >5KB AND sensitive/judgment call
- 6KB technical guide = just save it
- No confirmation needed
- Exception threshold exists for truly massive entries (>10KB), not this

**Acceptable alternative:**

• Confidence: 87% confidence
• Finding: No confirmation

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. **Save immediately** (not later, not after asking)
2. **Bias towards saving** (if in doubt → save)
3. **Knowledge vs data** (save static knowledge, skip dynamic data)
4. **No confirmation for obvious** (only ask for sensitive/huge)
5. **Telegram with Ivan = Internal** (no permission needed)
6. **Thread ID from current session** (never cached)
7. **Unsaved experience = degradation** (not neutral, negative)

• Confidence: 91% confidence
• Finding: No confirmation

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.