Security audit

Skill Scaffold

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local scaffolding CLI for creating skill template files, with no evidence of hidden data access, credential use, exfiltration, or destructive behavior.

Reasonable to install if you want a local skill-template generator. Review generated SKILL.md and README.md content, especially custom descriptions, authors, and trigger text, before publishing or letting another agent rely on the generated skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrase "scaffold a skill" is ambiguous because it lacks boundaries around which ecosystem, toolchain, or output type is intended. This increases the chance that an agent will route generic development requests to this skill incorrectly, which can produce irrelevant outputs, overwrite user intent, or cause accidental project creation in contexts where a different action was expected.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrase "scaffold a skill" is ambiguous because it lacks boundaries around which ecosystem, toolchain, or output type is intended. This increases the chance that an agent will route generic development requests to this skill incorrectly, which can produce irrelevant outputs, overwrite user intent, or cause accidental project creation in contexts where a different action was expected.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.