Security audit
Bcrypt Generate
Security checks across malware telemetry and agentic risk
Overview
The skill does a legitimate bcrypt task, but its instructions can expose real passwords by putting them directly into shell commands.
Review before installing or using with real passwords. The bcrypt function is legitimate, but users should avoid pasting real passwords into the shown one-line shell commands; safer instructions would read the password from stdin or an interactive prompt and validate the rounds value without exposing secrets.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.