Security audit

Sop Generator

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only SOP drafting skill with reasonable privacy cautions around transcripts and third-party automation tools.

Before installing or using this skill, treat recordings and transcripts as sensitive. Review and redact secrets, customer data, personal information, financial details, and internal strategy before sending content to third-party tools or saving SOP drafts in shared systems.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger list contains broad phrases like "document this process" and "write a procedure," which can plausibly appear in ordinary conversation and cause accidental invocation. This is not an exploit primitive by itself, but it can lead to unintended activation, unexpected handling of sensitive business content, and user confusion about when the skill is operating.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The automation section recommends sending Loom transcripts to external APIs and SaaS platforms like Claude, Zapier/Make, Notion, Slack, or email, but it does not warn users that transcripts may contain sensitive business, customer, employee, or credential-related data. In practice, this can cause unintentional data disclosure to third parties, broaden the data access surface, and create compliance or confidentiality issues.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.