TED Talk

Security checks across malware telemetry and agentic risk

Overview

This is a writing-only presentation skill that uses supplied or current conversation context and shows no evidence of hidden file access, external sharing, persistence, or destructive behavior.

Install this if you want help turning a conversation or topic into a long-form talk. Because it may synthesize the current chat, avoid invoking it in conversations containing private details unless you are comfortable with those details appearing in the generated draft, and review the output before sharing it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger condition allows invocation not only on explicit command but also "when deep technical insight emerges," which is subjective and can cause the skill to activate without clear user intent. In a skill that synthesizes the current conversation by default, unintended activation could expose or repackage sensitive in-conversation content the user did not mean to turn into a long-form output.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The title includes a non-default locale marker "(話)" and the trigger text uses Japanese ("明示呼出"), which may bias the skill toward a specific language or locale without explicit user opt-in. While not a classic security flaw, this can cause confusion, unexpected language switching, or misinterpretation of commands and outputs in multilingual environments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal