Recipes
Security checks across malware telemetry and agentic risk
Overview
The skill is narrowly about recipe lookup, but the reviewed package does not include the executable scripts it tells users and agents to run.
Treat this as a Review item rather than known malware. The skill appears intended for recipe lookup, but do not run the README install commands blindly because the actual CLI scripts are outside the reviewed bundle. Inspect the referenced repository and scripts first, avoid running them as root, and prefer a package that includes the executable code or pins a reviewed release.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
61/61 vendors flagged this skill as clean.