Security audit

提示词生成器

Security checks across malware telemetry and agentic risk

Overview

This is a prompt-template library with no executable code or system access, though some coding templates need careful review before use.

Reasonable to install as a prompt-template skill. Treat generated coding prompts as drafts: do not paste secrets into prompts, review generated code before running it, and add explicit safety requirements for scraping, file operations, scheduled jobs, and third-party API use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The web-scraping template directly encourages collection and storage of website data but does not warn about terms-of-service, copyright, privacy, or personal-data restrictions. In a prompt-generation skill, this omission can systematically steer users toward potentially unlawful or privacy-invasive scraping workflows without any safety framing.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The file-processing automation template asks for batch processing across source and target directories without caution about destructive writes, overwrites, or accidental modification of user files. Because this skill produces ready-to-use prompts, users may generate scripts that recursively alter or delete data at scale without backup or dry-run safeguards.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The scheduled-task template promotes unattended recurring execution but does not mention rate limits, duplicate runs, resource exhaustion, or repeated side effects on systems and data. While not inherently malicious, repeated automation can amplify mistakes and cause persistent operational or data integrity issues.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The external API integration template discusses authentication methods but gives no warning about secure credential storage, least-privilege access, or risks of transmitting sensitive data to third-party services. In a prompt template library, this can normalize unsafe handling of API keys and sensitive payloads in generated code.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.