Chart Generator (Alex)

• Outcome: Pass
• Latest audit: May 28, 2026 at 3:04 PM UTC
• Version:
  2.3.4

Overview

This looks like a normal chart-generation skill that writes requested chart outputs locally, with no evidence of network exfiltration or hidden privileged behavior.

Install only if you want a local chart generator. When using file-generating commands, specify the output path and avoid feeding sensitive datasets unless you are comfortable storing the resulting chart files locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 74% confidence
• Finding: Overly broad trigger terms like 'chart' and 'graph' can cause unintended invocation of the skill in contexts where the user did not intend to run a file-writing or command-backed tool. In agent ecosystems, accidental activation can lead to unnecessary file creation, exposure of user data to the tool pipeline, or confusing execution of the wrong capability.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The skill documents HTML/SVG file generation but does not prominently warn users that running certain commands will write files to disk. In an agent setting, silent file creation can surprise users, overwrite expected locations, or violate execution expectations, especially if output paths are agent-chosen or defaulted.

VirusTotal

No VirusTotal findings