素材库管理

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward ad-material library helper, with no evidence of hidden data access, exfiltration, persistence, or destructive deletion.

Install only if you are comfortable letting the agent manage ad materials and related prompts/metadata in the skill's library context. Treat archive/version actions as intentional changes to library state, and avoid storing confidential campaign details unless that is intended.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill advertises a `material-library.deleted` event but does not document any deletion command behavior, safety constraints, or user-facing warning about destructive operations. In a material library that stores business assets, undocumented deletion semantics can lead agents or users to trigger irreversible or unexpected data loss, especially if deletion is inferred or supported elsewhere in the implementation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal