Donor Message

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:22 PM UTC
• Version:
  1.0.0

Overview

This is a simple donor-message drafting skill with no code, credentials, background behavior, or external access.

Safe to install as a drafting aid. Users should avoid providing unnecessary donor personal data, payment details, or confidential fundraising records unless needed for the specific message they ask the agent to draft.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill's usage triggers are broad enough to match generic writing-assistance requests rather than a narrowly scoped donor-communication task. That can cause inappropriate activation in unrelated contexts, exposing user content to the skill and producing fundraising-oriented messaging where it was not intended, though the skill itself does not contain more dangerous behaviors such as exfiltration or instruction hijacking.

VirusTotal

59/59 vendors flagged this skill as clean.