素材库管理

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:24 PM UTC
• Version:
  1.0.0

Overview

This skill is a straightforward ad-material library helper, with no evidence of hidden data access, exfiltration, persistence, or destructive deletion.

Install only if you are comfortable letting the agent manage ad materials and related prompts/metadata in the skill's library context. Treat archive/version actions as intentional changes to library state, and avoid storing confidential campaign details unless that is intended.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill advertises a `material-library.deleted` event but does not document any deletion command behavior, safety constraints, or user-facing warning about destructive operations. In a material library that stores business assets, undocumented deletion semantics can lead agents or users to trigger irreversible or unexpected data loss, especially if deletion is inferred or supported elsewhere in the implementation.

VirusTotal

64/64 vendors flagged this skill as clean.