SPF Test

• Outcome: Pass
• Latest audit: May 28, 2026 at 4:50 AM UTC
• Version:
  1.0.0

Overview

This is an instruction-only coding workflow skill with disclosed persistent file-memory behavior and no bundled executable code or hidden data access.

Before installing, review the linked external repository because this scan only covers the submitted SKILL.md. If you use it, keep memory/log files inside the intended project, avoid saving secrets into persistent notes, and use multi-agent features only when you are comfortable sharing that project context.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description says to use it when starting any coding project or whenever planning, execution, debugging, or code review workflows are needed, which is broad enough to trigger on a large fraction of normal development requests. Overly broad activation increases the chance that this skill is invoked by default, causing unnecessary delegation to powerful workflows and file-writing behaviors without clear user intent.

VirusTotal

65/65 vendors flagged this skill as clean.