Status Page Gen

• Outcome: Review
• Latest audit: May 29, 2026 at 9:29 PM UTC
• Version:
  1.0.0

Overview

The skill appears purpose-aligned, but it needs review because its guide pushes users toward publicly publishing potentially sensitive service status details.

Install only if you are comfortable with the skill checking the services you configure and be careful not to publish internal hostnames, private URLs, service names, uptime history, or certificate details to a public Gist. Prefer local/private hosting or redact sensitive service metadata before sharing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes very broad phrases such as 'status page', 'uptime', and 'check my services', which can cause the skill to activate for ordinary user requests that may not specifically intend to run this capability. Over-broad activation increases the chance of unintended execution of network-checking workflows and can route unrelated prompts into this skill unexpectedly.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide explicitly instructs users to publish the generated status page to a public GitHub Gist, which can expose internal service names, hostnames, URLs, uptime history, and certificate status to anyone on the internet. In the context of a homelab or self-hosted environment, this disclosure can materially aid reconnaissance by revealing attack surface and operational details.

VirusTotal

66/66 vendors flagged this skill as clean.