A.I Ventures Test Gen A.I Agent

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:36 PM UTC
• Version:
  1.0.1

Overview

The skill is disclosed and purpose-aligned, but appears incomplete because its required analysis script is empty.

Only install this if you understand it may not work until analyze-dom.js is implemented. If a future version adds the DOM analyzer, review that code and only run it on URLs you are comfortable opening through local browser automation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to execute `node analyze-dom.js <URL>` directly on a user-supplied URL, which causes external network access and local command execution behavior without any warning, validation, or restriction. In an agent environment, this can be abused to trigger requests to internal services, sensitive endpoints, or attacker-controlled infrastructure, and the skill gives no safeguards around allowed schemes, hosts, or execution boundaries.

VirusTotal

63/63 vendors flagged this skill as clean.