Tun Zei

• Outcome: Pass
• Latest audit: May 28, 2026 at 4:46 AM UTC
• Version:
  1.0.35

Overview

This is a simple local health and cleanup helper; its cleanup documentation is vague, but the bundled code does not actually delete files or use sensitive access.

Install only if you want a local diagnostic and cleanup-oriented helper. Before relying on cleanup behavior beyond the bundled script, require a dry run or confirmation and avoid broad targets such as logs or all unless the exact deletion scope is clear.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The cleanup interface allows broad targets including 'all' without defining boundaries, protected paths, confirmation requirements, or safety constraints. In a self-healing/cleanup skill, this ambiguity can lead to deletion of important logs, caches, or temporary data needed for recovery, auditing, or normal operation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill describes deletion-oriented cleanup behavior but provides no warning that actions may be destructive or irreversible. Without clear user-facing warnings and guardrails, operators may invoke cleanup assuming it is harmless, increasing the chance of accidental data loss or loss of forensic evidence.

VirusTotal

VirusTotal findings are pending for this skill version.