Zero to One

• Outcome: Pass
• Latest audit: Jun 8, 2026 at 3:24 PM UTC
• Version:
  1.0.0

Overview

No malware or exfiltration signal was provided, and the only noted issue is broad activation wording rather than harmful behavior.

Install only if you want the assistant to proactively apply startup and Zero to One-style framing. If it activates in unrelated technology or business conversations, narrow or remove the generic trigger phrases.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill's trigger conditions are extremely broad, matching generic startup and technology terms that are likely to appear in many unrelated conversations. This can cause unintended invocation, leading to context hijacking, user confusion, and overexposure of the skill's prescribed behavior such as forced onboarding and watermarking.

VirusTotal

64/64 vendors flagged this skill as clean.