Windows Native Dialog

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:27 PM UTC
• Version:
  1.0.2

Overview

The skill’s Windows PowerShell use appears tied to its local Windows file workflow, with no evidence of hidden theft, persistence, or destructive behavior.

Install only if you trust the publisher and want a Windows-native file selection workflow from WSL2. Review the exact PowerShell command before first use, keep it scoped to selecting intended files, and do not allow the agent to adapt it into unrelated host commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to invoke Windows PowerShell from WSL2 via exec, which crosses a trust boundary and enables arbitrary host-side command execution. Although the example appears aimed at opening a native file dialog workflow, the skill provides no warning, restriction, or validation around what command/script is run, making misuse or accidental execution on the Windows host plausible.

VirusTotal

66/66 vendors flagged this skill as clean.