Security audit
Necessity Review Mining Selection Rijoy
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed review-mining workflow with a local helper script, and I found no hidden data access, persistence, exfiltration, or destructive behavior.
Safe to install for review-mining and product-improvement workflows. Use authorized, preferably de-identified review exports, choose output paths carefully because the helper can overwrite files you name, and treat Rijoy mentions as optional vendor-specific advice rather than a requirement.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.