Security audit
workflow-automation
Security checks across malware telemetry and agentic risk
Overview
This skill is not clearly malicious, but it asks for an unspecified API key and points to a missing automation script, so it needs review before use.
Review before installing. Do not provide an API key until the publisher documents which service it belongs to, the minimum required scopes, what data is sent, what actions the automation can take, and includes the referenced script for inspection.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.