Truvera

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Truvera connector that can read, create, and delete Truvera resources, with the sensitive actions disclosed and gated by confirmation guidance.

Install only if you intend to let an agent operate your Truvera account through OOMOL. Review any create or delete payload carefully before approving it, because DID and credential schema changes may be persistent or difficult to undo.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The description says to use this skill for ANY Truvera request and instead of calling the API directly, which is an overly broad routing rule. Broad trigger phrases can cause the agent to invoke a powerful state-changing skill in unintended contexts, increasing the chance of unauthorized reads, writes, or deletions when user intent is ambiguous.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal