Gemma 4 Developer Tool

• Outcome: Pass
• Latest audit: Jun 6, 2026 at 6:04 PM UTC
• Version:
  1.0.0

Overview

This skill is a coherent Gemma model development helper with sample app code and no evidence of hidden, destructive, or credential-stealing behavior.

Install only if you want a Gemma-focused coding/model workflow helper. Review the sample scripts before running them, especially the Gradio server and Vertex AI example, because they may download models, open a local app, use Google Cloud configuration, and consume compute or cloud quota.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The usage guidance is broad enough to activate for many ordinary development tasks, which can cause over-selection of this skill in contexts involving coding, analysis, or multi-step execution. In an agentic system, overly broad activation increases the chance the skill is invoked with unnecessary authority or workflow complexity, expanding exposure to tool misuse or unintended actions.

VirusTotal

65/65 vendors flagged this skill as clean.