Work Receipt

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:14 PM UTC
• Version:
  1.0.0

Overview

This skill is a straightforward coding-session summary helper, but its generated receipts may include private project or terminal details.

Install only if you are comfortable with the agent inspecting your current coding-session context. Review and redact generated receipts before sharing them in standups, tickets, PRs, or chat, especially for tokens, credentials, customer data, sensitive paths, command output, and unfinished security-sensitive work.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly analyzes sensitive local artifacts including git history, diffs, tests, and terminal commands, but it does not clearly warn users before doing so. This can lead to unintentional exposure of secrets, internal project details, command history, or proprietary work product in the generated receipt or any downstream sharing of that receipt.

VirusTotal

65/65 vendors flagged this skill as clean.