Builder Data

Security checks across malware telemetry and agentic risk

Overview

This skill is a read-only helper for Talent Protocol and GitHub lookups, with privacy considerations because it can query and correlate identity, wallet, reputation, location, and public GitHub data.

Install only if you are comfortable sending queried handles, wallet addresses, locations, and profile identifiers to Talent Protocol, and GitHub usernames to GitHub when enrichment is used. Keep TALENT_API_KEY and GITHUB_TOKEN in environment variables or a secret store, avoid pasting tokens into chats or logs, and use the GitHub token only when higher rate limits are needed. Be cautious with broad location or credential searches because they can reveal and correlate personal profile data at scale.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (18)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill description does not clearly warn that user-supplied identifiers such as handles, wallets, locations, and profile attributes will be sent to third-party services including Talent Protocol and optionally GitHub. This creates a privacy and consent risk because users may provide personal data without understanding it will be transmitted externally.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation explicitly instructs use of an API-key-authenticated service to retrieve profile, account, social, verification, credential, and location-linked reputation data, but it provides no privacy notice, consent guidance, or data-minimization boundaries. In an agent skill context, this increases the risk that personal identifiers and enriched profile data will be transmitted to a third party without the user understanding what data is being looked up or exposed.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The examples instruct users to send identity handles and profile identifiers to an external API using an API key, but provide no warning about credential handling, consent, logging, or the privacy implications of transmitting linked identity and wallet data. In an agent-skill context, this omission is material because users may unknowingly disclose third-party identifiers or expose secrets in shell history, logs, or shared environments.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The GitHub enrichment section directs users to send resolved usernames to GitHub APIs and suggests obtaining a GitHub token, but does not warn that the token is sensitive or that enrichment shares user-linked identity data with a second external service. This can lead to inadvertent token leakage and unnecessary cross-service profiling of individuals.

External Transmission

Medium
Category
Data Exfiltration
Content
**USE POST with `customQuery` regex:**

```bash
curl -X POST -H "X-API-KEY: $TALENT_API_KEY" -H "Content-Type: application/json" \
  "https://api.talentprotocol.com/search/advanced/profiles" \
  -d '{
    "customQuery": {
Confidence
89% confidence
Finding
curl -X POST -H "X-API-KEY: $TALENT_API_KEY" -H "Content-Type: application/json" \ "https://api.talentprotocol.com/search/advanced/profiles" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl -H "X-API-KEY: $TALENT_API_KEY" \
  "https://api.talentprotocol.com/search/advanced/profiles?query%5Bidentity%5D=jessepollak&query%5Bidentity_type%5D=twitter"
```

| Parameter | Example |
Confidence
86% confidence
Finding
https://api.talentprotocol.com/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl -H "X-API-KEY: $TALENT_API_KEY" \
  "https://api.talentprotocol.com/profile?id={profile_id}"
```

| Parameter | Description |
Confidence
91% confidence
Finding
https://api.talentprotocol.com/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl -H "X-API-KEY: $TALENT_API_KEY" \
  "https://api.talentprotocol.com/accounts?id={profile_id}"
```

**Response:**
Confidence
93% confidence
Finding
https://api.talentprotocol.com/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl -H "X-API-KEY: $TALENT_API_KEY" \
  "https://api.talentprotocol.com/socials?id={profile_id}"
```

**Response:**
Confidence
90% confidence
Finding
https://api.talentprotocol.com/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl -H "X-API-KEY: $TALENT_API_KEY" \
  "https://api.talentprotocol.com/credentials?id={profile_id}"
```

**Response:**
Confidence
94% confidence
Finding
https://api.talentprotocol.com/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl -H "X-API-KEY: $TALENT_API_KEY" \
  "https://api.talentprotocol.com/human_checkmark?id={profile_id}"
```

**Response:** `{ "human_checkmark": true }`
Confidence
88% confidence
Finding
https://api.talentprotocol.com/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl -H "X-API-KEY: $TALENT_API_KEY" \
  "https://api.talentprotocol.com/data_points?id={profile_id}"
```

---
Confidence
80% confidence
Finding
https://api.talentprotocol.com/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 1. Search by identity
curl -H "X-API-KEY: $TALENT_API_KEY" \
  "https://api.talentprotocol.com/search/advanced/profiles?query%5Bidentity%5D={handle}&query%5Bidentity_type%5D={identity_type}"
# Response: profiles[0].id → use as profile_id
Confidence
88% confidence
Finding
curl -H "X-API-KEY: $TALENT_API_KEY" \ "https://api.talentprotocol.com/search/advanced/profiles?query%5Bidentity%5D={handle}&query%5Bidentity_type%5D={identity_type}" # Response: profiles[0].id → us

External Transmission

Medium
Category
Data Exfiltration
Content
# 2. Get wallets from profile ID
curl -H "X-API-KEY: $TALENT_API_KEY" \
  "https://api.talentprotocol.com/accounts?id={profile_id}"
# Filter: source = "wallet"
```
Confidence
86% confidence
Finding
https://api.talentprotocol.com/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl -X POST -H "X-API-KEY: $TALENT_API_KEY" -H "Content-Type: application/json" \
  "https://api.talentprotocol.com/search/advanced/profiles" \
  -d '{
    "customQuery": {
      "regexp": {
Confidence
83% confidence
Finding
https://api.talentprotocol.com/

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
curl -X POST -H "X-API-KEY: $TALENT_API_KEY" -H "Content-Type: application/json" \
  "https://api.talentprotocol.com/search/advanced/profiles" \
  -d '{
    "customQuery": {
      "regexp": {
Confidence
83% confidence
Finding
https://api.talentprotocol.com/

External Transmission

Medium
Category
Data Exfiltration
Content
{ "source": "github", "username": "jessepollak" }

# 2. Query GitHub API
curl "https://api.github.com/users/{username}"                    # Profile, company
curl "https://api.github.com/users/{username}/repos?sort=stars&per_page=5"   # Top repos
curl "https://api.github.com/users/{username}/repos?sort=pushed&per_page=5"  # Recent
curl "https://api.github.com/users/{username}/events/public"      # Commits, activity
Confidence
90% confidence
Finding
https://api.github.com/

External Transmission

Medium
Category
Data Exfiltration
Content
curl "https://api.github.com/users/{username}/repos?sort=pushed&per_page=5"  # Recent
curl "https://api.github.com/users/{username}/events/public"      # Commits, activity
curl "https://api.github.com/search/issues?q=author:{username}+type:pr+state:open&per_page=5"  # Open PRs
curl "https://api.github.com/repos/{owner}/{repo}/readme"         # README
```

GitHub token for higher rate limits: https://github.com/settings/tokens
Confidence
87% confidence
Finding
https://api.github.com/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal