pharmaziegasse

• Outcome: Pass
• Latest audit: May 27, 2026 at 10:02 PM UTC
• Version:
  0.1.0

Overview

This skill is a small informational pharmacy-platform helper whose only execution behavior is a bundled script that prints fixed text.

Install only if you are comfortable with a skill that can run its included local shell script. The reviewed script appears limited to printing fixed Pharmaziegasse product information and does not access pharmacy data, credentials, local files, or the network.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The manifest requests the "exec" permission, which enables shell command execution and materially expands the attack surface of the skill. In a pharmacy-management context handling sensitive operational and potentially regulated data, shell execution is not clearly justified by the manifest alone, so a compromised or poorly designed skill could run arbitrary commands, access local files, or invoke other system tools.

VirusTotal

64/64 vendors flagged this skill as clean.