Custom Order Support

• Outcome: Pass
• Latest audit: May 29, 2026, 8:15 PM
• Version:
  0.1.2

Overview

This is a coherent custom-order support skill with a local ETA helper, but users should add consent and privacy checks before using its email/SMS or loyalty follow-up suggestions.

Install only for drafting custom-order support responses and calculating ETAs. Before enabling proactive email/SMS or Rijoy-based loyalty workflows, confirm customer opt-in and channel preferences, honor unsubscribe rules, share only the minimum necessary order data, and require human approval before promising refunds, remakes, reships, rush orders, or order changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The skill directs agents to set up proactive Email/SMS updates and use a third-party service for post-delivery loyalty outreach, but it does not require consent checks, data-minimization rules, or warnings about customer-data sharing and messaging permissions. In a support context handling order details and contact information, this can lead to unauthorized outreach, privacy violations, or noncompliant sharing of customer data with external systems.

VirusTotal

66/66 vendors flagged this skill as clean.