SSL Certificate Manager

• Outcome: Review
• Latest audit: May 29, 2026 at 9:27 PM UTC
• Version:
  1.0.0

Overview

This certificate-management skill is purpose-aligned, but it can issue certificates and retrieve private keys without clearly documented authentication, authorization, or key-handling safeguards.

Review before installing or using with real domains. Use only for domains you control, verify the provider requires strong authentication and per-domain authorization, start with staging certificates, and prevent agents from printing, logging, or storing private keys outside a secret manager.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documented download endpoint explicitly allows retrieval of `private.key`, which is highly sensitive key material, yet the skill description does not prominently warn users about the risk or prescribe strict handling requirements. In a certificate-management skill, exposing private keys is especially dangerous because compromise of the key enables impersonation of the protected domain and decryption of traffic where forward secrecy is absent or operational misuse occurs.

VirusTotal

66/66 vendors flagged this skill as clean.