Data Governance Maturity

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:32 PM UTC
• Version:
  1.0.0

Overview

This skill is a straightforward external API integration for data governance maturity assessments, with a privacy caveat about the assessment data and identifiers it sends.

Before installing, confirm you trust the ToolWeb/API provider and avoid submitting secrets, unnecessary personal identifiers, or highly detailed internal weaknesses unless your organization is comfortable sending that information to the external assessment service.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill requests userId, sessionId, timestamps, and assessment responses but provides no privacy notice, retention policy, minimization guidance, or handling constraints. Even if these fields are not inherently secret, they can become sensitive when tied to organizational governance posture and user activity, creating unnecessary exposure and compliance risk when sent to a third-party service.

VirusTotal

64/64 vendors flagged this skill as clean.