Linked List Practice Helper 2

• Outcome: Pass
• Latest audit: Jun 14, 2026 at 7:22 AM UTC
• Version:
  0.1.1

Overview

The skill appears to be a low-impact linked-list practice/workflow helper with overly broad activation wording, but no evidence of hidden actions, data access, persistence, or malicious behavior.

Before installing, review the skill's activation metadata and consider narrowing generic trigger wording so it only runs for linked-list practice or the specific linked-list feature workflow. Based on the available evidence, installation risk appears low.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description is broad enough to match generic requests for 'general-help', 'feat', or implementation support, which can cause unintended invocation outside the narrowly intended linked-list use case. Overbroad activation increases the chance that this skill intercepts unrelated tasks, leading to incorrect guidance, context confusion, or privilege/route abuse in agent systems that dispatch skills by description matching.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: The trigger list includes highly generic words like 'feat', 'add', 'frequently', and 'asked', which are likely to appear in many unrelated user requests. In systems that auto-select skills from keyword matches, this can misroute prompts to this skill, creating prompt-selection hijacking, degraded reliability, and accidental disclosure of unrelated context to an irrelevant skill.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill allows implicit invocation without any visible activation constraints, which means the agent may auto-select this skill based on broad matching rather than explicit user intent. That creates a prompt-surface expansion risk: the skill can be invoked in contexts where its guidance is irrelevant, leading to unintended actions, leakage of context to the skill, or manipulation through ambiguous routing.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill declares a very broad category ('general-help') and broad usage signals that are not tightly scoped to the specific linked-list feature request. This increases the chance of accidental activation on unrelated user prompts, causing the agent to inject irrelevant workflow guidance or trigger the wrong skill when a more appropriate one should respond.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger phrases include common natural-language requests like 'Help me feat: Add frequently asked Linked List problems...' and 'I need a practical workflow...', which overlap with ordinary user speech. Because the skill is designed for broad assistance rather than a tightly constrained operation, these phrases can cause unintentional invocation and response hijacking in benign conversations about linked lists or software improvements.

VirusTotal

64/64 vendors flagged this skill as clean.