Security audit

Scavio Google

Security checks across malware telemetry and agentic risk

Overview

This appears to be a web-search skill whose external lookup behavior is purpose-aligned, with privacy disclosure and trigger-scope notes for users to consider.

Safe to install if you want Scavio-backed web search, but treat every query as data sent to an external service. Do not use it with passwords, API keys, private documents, or confidential business details unless you are comfortable sharing that information with the provider.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger guidance is very broad and directs the agent to use this skill for many generic requests involving web lookup or current facts. In an agent environment, overly permissive trigger conditions can cause unintended external calls, increasing privacy exposure and unnecessary transmission of user prompts to a third-party service.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill encourages searching current information but does not clearly warn that user queries are sent to Scavio, an external third-party API. This creates a privacy and data-handling risk because users or upstream agents may disclose sensitive prompts without informed consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:37