Ai Company Cmo 3.0.0

• Outcome: Review
• Latest audit: May 29, 2026 at 9:34 PM UTC
• Version:
  3.0.1

Overview

This appears to be a marketing strategy skill, but it requests broad file, API, and cross-agent authority without enough concrete limits.

Review this skill before installing in a real workspace. Use least-privilege limits, require explicit confirmation before file writes, API calls, or cross-agent messages, and verify the intended published version because the included metadata and review notes are inconsistent.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manifest includes several broad generic triggers for common marketing concepts, increasing the chance this skill activates during ordinary conversation rather than explicit invocation. Because the skill has read/write file access, network API access, and MCP capabilities, unintended routing could expose user context to a skill that was not deliberately selected.

VirusTotal

66/66 vendors flagged this skill as clean.