Technical Blog Writing

• Outcome: Review
• Latest audit: May 28, 2026 at 10:03 AM UTC
• Version:
  0.1.5

Overview

This is a legitimate technical writing helper, but it includes executable examples for installing a third-party CLI and posting publicly to X without clear consent boundaries.

Read SKILL.md before installing. Prefer manual download and checksum verification over piping the installer to sh, use an inference.sh account with appropriate limits, avoid sending confidential drafts or private code to external services, and do not run the X posting example unless you have reviewed the final text and explicitly intend to publish it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The quick-start instructions tell users to install remote CLI tooling via a piped shell script and authenticate, and the skill later includes examples that can perform external network actions and account-affecting operations. Presenting these actions without prominent warnings increases the chance that an agent or user triggers downloads, authentication, or posting behavior without informed consent.

VirusTotal

66/66 vendors flagged this skill as clean.