Proof-of-Quality - BTC PoW Verifiable Excellence

• Outcome: Review
• Latest audit: May 28, 2026, 4:36 AM
• Version:
  1.0.0

Overview

This skill does not appear to steal data or install itself, but its advertised proof-of-quality is not a real benchmark and could mislead users.

Install only if you understand this is a toy or demonstration, not a trustworthy quality or security attestation. Run it with an explicit intended skill path, avoid cron unless you deliberately want recurring runs, and do not rely on its PoQ output for approving other skills.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The activation guidance is overly broad and underspecified, which increases the chance the skill will be invoked in inappropriate contexts or on untrusted targets. In an agent ecosystem, vague trigger language can cause unnecessary execution of a skill that reads paths and performs validation-like actions, expanding attack surface and risking misuse.

VirusTotal

65/65 vendors flagged this skill as clean.