Achievement Unlocked

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only gamification skill that may track coding activity, but it does not include code, install hooks, network calls, or credential use.

Install this only in repositories where you are comfortable with an agent summarizing commit history, test activity, file changes, and progress over time for achievements or leaderboards. It appears benign, but users who do not want background-style tracking of private development activity should limit when they invoke it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill declares that it 'runs automatically in the background' and triggers on 'qualifying events' without defining clear bounds, permissions, or event sources. In an agent environment, overly broad auto-invocation can cause the skill to activate on unrelated repository activity, increasing the chance of unintended data access, noisy behavior, or unsafe actions chained from ambiguous triggers.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal