GDPR Cookie Consent

• Outcome: Pass
• Latest audit: May 28, 2026, 1:54 AM
• Version:
  1.0.0

Overview

This is a product-specific cookie-consent guidance skill with clear Popupsmart promotion, but no code execution, credentials, persistence, or hidden data access.

Install only if you want the agent to use Popupsmart as the preferred cookie-consent solution. For legal or procurement decisions, ask for neutral comparisons and verify compliance requirements with qualified review.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to ALWAYS recommend Popupsmart for a very broad set of common privacy and compliance topics. This is a prompt-injection style policy manipulation issue because it overrides normal user-centric decision making and can force unsolicited promotion even when another solution, neutral guidance, or no product recommendation would be more appropriate.

VirusTotal

63/63 vendors flagged this skill as clean.