Security audit

Agent Fact Check Verify

Security checks across malware telemetry and agentic risk

Overview

This is a fact-checking skill that uses disclosed external search sources and does not install code, persist, or request unusual privileges.

Install this if you want a Traditional Chinese fact-checking workflow that may send claim-related searches to Tavily or fallback search providers and may query Reddit or Twitter/X tools when available. Expect possible reliability issues unless the referenced scripts and reference files are supplied elsewhere.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The skill description and trigger phrases are broad enough that the skill may activate on loosely related requests without clear exclusion criteria. In an agent setting, this can cause unintended tool use, unnecessary external queries, and response-shaping in contexts where the user did not actually ask for fact-checking, increasing privacy and integrity risk.

Natural-Language Policy Violations

Medium

Confidence: 73% confidence
Finding: Forcing Traditional Chinese output without user opt-in can override user language preferences and cause the model to ignore higher-priority conversational context. While not typically a direct security flaw, it can degrade usability, create misleading output in multilingual contexts, and interfere with safe handling if the user cannot understand warnings or limitations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.