AR VR Developer

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:28 PM UTC
• Version:
  1.0.0

Overview

This is a straightforward third-party AR/VR career-roadmap API skill, with a privacy caveat around submitted assessment and tracking data.

Treat this as a third-party API: avoid submitting confidential employer/client details or unnecessary personal identifiers. Use a pseudonymous sessionId where possible and omit userId unless you trust the provider's data handling and retention practices.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly describes capturing session tracking data and optional user identifiers, but provides no privacy notice, retention policy, minimization guidance, or handling constraints. Even though the data is not highly sensitive by itself, combining career assessment details, session IDs, timestamps, and user IDs enables profiling and linkability across requests, creating unnecessary privacy and compliance risk.

VirusTotal

66/66 vendors flagged this skill as clean.