Starwars

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple Star Wars lookup helper that uses a public API and shows no hidden data access or harmful behavior in the reviewed bundle.

Reasonable to install for ordinary Star Wars lookups. Be aware that use may contact swapi.dev with lookup terms, and inspect the external GitHub repository separately before following the manual clone, chmod, or /usr/local/bin symlink instructions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The instruction "When user asks about Star Wars" is overly broad and can cause the skill to activate for generic conversational queries, even when the user did not intend to invoke this tool. In an agent setting, broad activation increases the chance of unnecessary external API calls and tool overuse, which can create privacy, reliability, or prompt-routing issues even though the skill itself is not overtly dangerous.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal