VATlayer

Security checks across malware telemetry and agentic risk

Overview

This is a coherent VATlayer connector skill that uses OOMOL's oo CLI for VAT rate, VAT number validation, and price calculation tasks, with no evidence of hidden or destructive behavior.

Install this only if you intend to use OOMOL's oo CLI with a connected VATlayer account. Be aware that VAT numbers, IP or country inputs, and pricing data may be sent to the VATlayer connector, and OOMOL billing or API usage limits may apply. Review the oo CLI install step before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The instruction to use this skill for "ANY VATlayer request" and effectively prefer it over direct API use is overly broad and can cause unintended invocation in cases only loosely related to VATlayer or VAT topics. That increases the chance of misrouting user tasks, over-granting tool usage, and performing connector-backed lookups when a narrower or safer handling path would be more appropriate.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal