RedHat Command Execution

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.0

Overview

This is a small instruction-only command-running skill with visible safety checks, though its activation metadata is malformed and should be fixed.

Install only if you want an agent helper for terminal-command workflows. Review each command, working directory, expected side effects, and any destructive, installer, network, or remote-script action before allowing execution; also treat the RedHat-style publisher naming as unverified unless you have independent trust in the publisher.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger definition is effectively unspecified (`System.Object[]`), so the skill's activation scope is ambiguous and may allow invocation in unintended contexts. For a skill whose purpose is terminal command execution, weak scoping materially increases the chance of accidental or unauthorized activation, which could lead to risky command paths being exposed more broadly than intended.

VirusTotal

63/63 vendors flagged this skill as clean.