Security audit

Adaptive Reasoning

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only skill that transparently changes reasoning behavior and does not request files, credentials, network access, or code execution.

Install this only if you want the assistant to automatically decide when to spend more reasoning effort. Expect some responses to be slower or more detailed; disable the skill or ask for a quick answer when speed and brevity matter.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

Confidence: 95% confidence
Finding: The skill is explicitly designed to trigger on every user message, making it a global behavioral modifier rather than a narrowly scoped capability. That broad scope can override user preference for concise responses, increase token usage, and cause unintended reasoning-mode activation across unrelated prompts, which is risky for a preprocessing skill that alters model behavior by default.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The automatic activation logic is underspecified and instructs the agent to 'just activate' reasoning silently based on a subjective scoring system, with side effects such as appending indicators and invoking internal commands. Because the thresholds and criteria are loose, the skill can unpredictably escalate reasoning state, creating inconsistent behavior, hidden state changes, and unnecessary resource consumption.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.