client-onboard

Security checks across malware telemetry and agentic risk

Overview

This skill creates local freelance client onboarding documents as advertised, with no evidence of hidden data access or harmful behavior.

Install this only if you want an agent to create onboarding files in the current workspace. Review generated business assumptions, payment terms, the client kickoff message, and especially CLAUDE.md before sending or reusing them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger guidance is broad enough that the skill may activate on loosely related phrases and generate files or planning artifacts when the user did not clearly intend to run onboarding. In an agent setting, over-broad invocation can cause unintended writes, directory creation, and workflow changes, especially because the skill is allowed to use Write and Bash.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal