Security audit
Pokemon
Security checks across malware telemetry and agentic risk
Overview
This is a simple Pokémon lookup skill that discloses its PokéAPI use and shows no evidence of sensitive access, persistence, or destructive behavior.
Install this if you want an agent helper for Pokémon facts and are comfortable with it making read-only requests to PokéAPI. Because the reviewed package is documentation-only while the README references executable scripts from the GitHub install source, verify the installed repository contains the expected pokemon wrapper and scripts before relying on it.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.