Sovereign Project Guardian

• Outcome: Pass
• Latest audit: May 28, 2026 at 7:19 AM UTC
• Version:
  1.0.0

Overview

This is a disclosed repository health audit skill; it can inspect project files and suggest audit tools, but the artifacts do not show hidden execution, persistence, or data exfiltration.

Install this only if you want an agent to inspect the selected repository. Before running it on sensitive code, tell the agent to mask any discovered secrets and to ask before running dependency-audit commands or making remediation changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The README advertises very broad natural-language invocation phrases such as 'Evaluate the health of this project' and 'tell me what to fix first,' which are likely to overlap with normal user conversation. In agentic environments that auto-route based on semantic similarity, this can cause the skill to activate unintentionally on unrelated prompts, leading to unnecessary repository scanning, disclosure of project metadata in responses, or interference with higher-priority tasks.

VirusTotal

62/62 vendors flagged this skill as clean.