UXLens

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.2.0

Overview

UXLens is a simple instruction-only skill for sending website audit requests to the UXLens API, with the main caution being third-party handling of audited site data.

Before installing, use a revocable UXLENS_API_KEY and only audit sites you are authorized to submit to UXLens. Avoid confidential internal, staging, authenticated, or client sites unless you have approval and are comfortable with the service processing discovered pages and metadata.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill encourages users to submit arbitrary URLs and supports full-site crawling, but it does not clearly disclose that those URLs and discovered page data are transmitted to the external UXLens service for processing. This can cause unintended data exposure, especially if an agent is pointed at staging, intranet-accessible, authenticated, or otherwise sensitive sites under the assumption the audit is local-only.

VirusTotal

64/64 vendors flagged this skill as clean.