Aloudata CAN SKILLS - metric-query

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:23 PM UTC
• Version:
  1.0.2

Overview

This is an instruction-only Aloudata metric-query helper that discloses its API-key and outbound gateway use, with no hidden code or persistence found.

Install this only if you want the agent to use your Aloudata CAN API key to look up metric metadata and query gateway.can.aloudata.com. Use a scoped key if available, review generated request JSON before execution, and avoid sending sensitive metric filters unless that data is appropriate for the Aloudata gateway.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

High

• Confidence: 93% confidence
• Finding: The skill uses extremely broad mandatory trigger language such as '包括但不限于', '都应使用', and '即使……也应触发', which can cause the agent to invoke this network-capable skill for loosely related requests. In context, that increases the chance of unnecessary outbound calls and unintended data handling, especially because the skill requires external API lookups before building responses.

VirusTotal

65/65 vendors flagged this skill as clean.