Back to skill

Security audit

QSR Shift Reflection

Security checks across malware telemetry and agentic risk

Overview

This is a prompt-only restaurant shift handoff skill whose data storage and follow-up behavior are disclosed and aligned with its purpose.

Before installing, confirm that the companion memory engine is configured with the right store boundaries and retention policy, because the skill records operational incidents and handoff notes. The publisher should clarify the single background-running phrase, but the artifact otherwise describes operator-triggered, store-scoped behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The architecture section states that Function 4 'Runs continuously in the background,' which implies autonomous execution. Elsewhere, the normative storage/autonomous-behavior sections say the skill is not a daemon, does not run on a schedule, and only surfaces items in response to operator-initiated check-ins or commands. This is an active contradiction in the skill's own documentation about runtime behavior.

Vague Triggers

Low
Confidence
84% confidence
Finding
The phrase 'At the start of every new shift interaction — before running a new reflection, before any other operational discussion' does not clearly define what counts as a 'new shift interaction.' In a markdown skill description, this broad wording could cause the skill to activate during ordinary shift-related chat without a precise trigger boundary or exclusion examples.

Vague Triggers

Low
Confidence
79% confidence
Finding
The listed commands are natural-language phrases rather than tightly scoped command syntax, and 'Show open issues' in particular is broad enough to overlap with ordinary user requests. The section does not provide exclusions, required prefixes, or command-only constraints to prevent unintended invocation.

Skill Enumeration

Medium
Category
Agent Snooping
Content
Every record is tagged with a single store identifier and lives inside that store's namespace. Records never cross store boundaries. In multi-location deployments, each store has its own isolated reflection archive and open issue list. Cross-store rollups (see `ADAPTING THIS SKILL → Multi-location operations`) are produced by reading each store's namespace independently and combining the results at report time, not by merging the underlying records.

### Sibling skill access

Other skills in the QSR Operations Suite may read from this skill's records *only* through the same store-scoped namespace and *only* in read-only mode. The integrations listed under `CONNECTING TO OTHER SKILLS` are read paths, not write paths. No sibling skill modifies, deletes, or re-exports reflection or open issue records.
Confidence
85% confidence
Finding
access Other skills

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.