pua-skill

Security checks across malware telemetry and agentic risk

Overview

This is a prompt-only skill that pushes an agent to troubleshoot more persistently, with no code, hidden install behavior, credentials, or persistence found.

Install this only if you want the agent to be more forceful and persistent during stuck tasks. In sensitive projects, set clear limits on which files, commands, network calls, time budget, and externally visible actions are allowed, and require explicit approval for destructive, costly, or public changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The skill enables implicit invocation but does not define a narrow, explicit trigger condition, which can cause the agent to apply this high-pressure behavioral modifier in contexts the user did not intend. Because the skill is designed to push persistence and override tendencies to stop or defer, unexpected activation can distort agent behavior, increase unsafe autonomy, and interfere with normal safety-sensitive decision boundaries.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal