Security Stack Builder

• Outcome: Review
• Latest audit: May 29, 2026 at 9:29 PM UTC
• Version:
  1.0.0

Overview

This skill is review-worthy because it appears to send security assessment details with tracking identifiers without explaining how that business data is handled.

Install only if you are comfortable sending the assessment content and identifiers to the service. Avoid including confidential security posture, compliance scope, vendor-selection details, or real user identifiers unless you have an appropriate privacy/security agreement and understand retention and access controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill documentation explicitly encourages submission of organizational assessment data along with tracking identifiers such as sessionId, userId, and timestamps, but provides no privacy notice, retention policy, minimization guidance, or warning about handling potentially sensitive business metadata. In a security-focused product, this context makes the omission more concerning because the collected data can reveal security posture, compliance scope, deployment model, and vendor-selection priorities that are valuable for profiling or targeting an organization.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The schema collects session identifiers and timestamps, which can become tracking data, yet the API spec provides no disclosure, minimization guidance, or handling constraints. In a security-focused skill, users may provide sensitive organizational assessment data, so undisclosed identifier collection increases privacy and telemetry risk if retained, correlated, or logged.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The request schema includes an optional userId field without any warning, purpose limitation, or privacy disclosure. Because this skill processes potentially sensitive cybersecurity posture information, transmitting a user-linked identifier can enable unnecessary attribution, profiling, or cross-session correlation if intercepted, logged, or misused.

VirusTotal

63/63 vendors flagged this skill as clean.