Security audit

Skill Vet

Security checks across malware telemetry and agentic risk

Overview

No artifact-backed malicious or review-worthy behavior was identified from the available evidence, but the actual skill contents were not clearly present for full verification.

Proceed as benign based on the available scanner evidence, but treat confidence as limited until the exact skill files and install metadata are available for review.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: vetting.cjs:69

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: vetting.cjs:14