Shike Multi Agent

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:39 PM UTC
• Version:
  1.5.0

Overview

This skill is a disclosed multi-agent dispatcher; its contact and payment metadata is unnecessary but does not create malicious behavior.

Installing is reasonable if you want a persistent multi-agent delegation workflow. Treat the listed contact and payment handles as optional publisher metadata, not required setup, and avoid sending secrets or sensitive private data into tasks that will be copied to child-agent sessions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The manifest embeds personal payment handles and contact solicitation unrelated to the technical function of the skill. While not direct code execution risk, this is dangerous because it introduces unnecessary sensitive personal and financial data into distributed skill metadata, which can enable social-engineering, trust abuse, or unwanted data propagation across registries and logs.

VirusTotal

67/67 vendors flagged this skill as clean.