Process Flow Navigator

Security checks across malware telemetry and agentic risk

Overview

This workflow navigator is mostly coherent, but its included command-line helper can run unintended local Python code if given a crafted node name.

Read the CLI helper before installing if you plan to use it. The skill's data and documentation are local and purpose-aligned, but use only known node IDs with scripts/navigate.sh, or patch the script to pass the node as a Python argument instead of embedding it in Python source.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The outcome text for the final judgment includes the vague route '继续流转 (根据来源节点决定去向)' instead of a concrete, machine-resolvable destination. In a navigation skill, this ambiguity can cause inconsistent routing, incorrect process guidance, or downstream logic errors when an agent or user relies on the JSON as authoritative workflow data.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal