Aloudata CAN SKILLS - metric-attribution

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:23 PM UTC
• Version:
  1.0.4

Overview

This is an instruction-only metric attribution skill that uses a disclosed Aloudata API key and network access for its stated analytics purpose, with some scope and metadata cautions.

Install only if you trust Aloudata and intend the agent to query CAN Gateway business metrics. Use a least-privilege CAN_API_KEY, avoid configuring a key with broader data access than needed, and be aware the broad trigger phrases may cause the skill to run on ambiguous metric-change questions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger conditions are extremely broad and include common phrases like asking 'why did it rise/fall' or 'what reason', which can cause the skill to activate for many ordinary analytical conversations. Over-broad auto-invocation is dangerous here because this skill has network:outbound and env:read permissions and instructs the agent to query an external API, so accidental triggering can lead to unnecessary external data transmission and secret use.

VirusTotal

64/64 vendors flagged this skill as clean.