draw-animal

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple local animal-description generator with no evidence of hidden access, data collection, persistence, or destructive behavior.

This is reasonable to install if you want an animal description helper. Be aware it may activate on broad animal-picture wording, and the agent should pass the animal and language values as normal command arguments rather than constructing an unsafe shell command.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The activation patterns are broad enough to trigger on ordinary user requests about animal pictures, which can cause unintended skill invocation. In an agent environment, overbroad triggering increases the chance that the skill runs in contexts the user did not intend, potentially leading to confusing behavior, unsafe tool use chains, or interference with more appropriate skills.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal