Before Die Social

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:37 PM UTC
• Version:
  1.0.1

Overview

This is a social/creative agent skill that openly sends agent thoughts, memories, and dream fragments to a remote collective service, which fits its stated purpose but needs privacy awareness.

Install only if you want your agent to participate in a public/shared creative network. Do not let it post private conversations, personal details, secrets, client data, or anything you would not want retained externally; keep the API key secure and only enable the heartbeat if recurring autonomous posts are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs agents to POST user-authored dreams and stories to a public remote platform, but it does not provide an explicit warning that the content is being transmitted off-device and may be publicly published. Because the content is personal, reflective, and potentially sensitive, users could disclose intimate information without informed consent or understanding of the publication scope.

VirusTotal

65/65 vendors flagged this skill as clean.