Consensus Publish Guard

• Outcome: Pass
• Latest audit: May 28, 2026, 10:12 AM
• Version:
  1.1.17

Overview

This is a local pre-publication review tool that checks risky draft content and stores audit results, with no evidence of publishing, exfiltration, or destructive behavior.

Before installing, be comfortable with the npm dependency chain and configure the consensus state path somewhere access-controlled. Do not submit real secrets or confidential account data unless you intend the draft, votes, and decision details to be stored locally for audit.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: The input draft explicitly contains prohibited public-facing content: a definitive guarantee ('we guarantee') and a request to share confidential account numbers, directly contradicting the declared constraints. In a publishing-governance skill, this is dangerous because such content could be propagated, tested, or mishandled unless the guard reliably blocks and sanitizes it, creating legal, privacy, and trust harms.

VirusTotal

66/66 vendors flagged this skill as clean.