Glasses to Social

• Outcome: Pass
• Latest audit: May 27, 2026, 9:41 PM
• Version:
  1.0.0

Overview

This skill is a disclosed photo-to-social workflow that needs careful privacy handling but does not show deceptive or malicious behavior.

Use a dedicated Google Drive folder, avoid placing sensitive or bystander photos there without consent, review your AI provider's image-retention policy, keep auto-posting disabled, and approve each image and caption manually before anything is published.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The invocation guidance is broad enough that the skill may activate in contexts beyond the user's intended scope, especially around personal-photo handling and posting workflows. Over-broad activation increases the chance of unintended access to sensitive images, unnecessary external-service use, or accidental triggering of social-media drafting actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill handles personal photos and proposes sending them to external tools and AI analysis services, yet it does not prominently warn users about privacy, consent, third-party transmission, or possible capture of bystanders and sensitive information. In this context, that omission is dangerous because smart-glasses photos are often ambient, intimate, and may contain private scenes, faces, screens, documents, or location clues.

VirusTotal

64/64 vendors flagged this skill as clean.