Training Report

• Outcome: Pass
• Latest audit: May 28, 2026 at 6:28 AM UTC
• Version:
  1.0.1

Overview

The skill appears purpose-aligned, with the main caution being careful handling of personal details in generated reports.

Before installing, decide whether names, contact details, or identifiable feedback are truly needed. Prefer anonymized or aggregated inputs, confirm who will receive any report, and avoid including sensitive personal observations unless there is clear consent and a clear purpose.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly solicits named individual feedback, background, starting level, behavior, and contact details, and may place them into a report without any built-in privacy notice, minimization rule, or consent check. In common workplace settings, this can lead to unnecessary collection and disclosure of personal or performance-related information, especially when reports are shared with management or external clients.

VirusTotal

63/63 vendors flagged this skill as clean.