Skylv Api Resilience Handler

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:44 PM UTC
• Version:
  1.0.0

Overview

This appears to be a local API error analysis helper; its main risk is that the optional log command stores raw error text on disk.

Install only if you are comfortable with a local CLI helper that can write error messages and context to .api-errors.json. Avoid logging API keys, bearer tokens, request payloads, customer data, or internal URLs, and delete the log file if sensitive details are captured. Treat retry output as advice rather than an automatic retry or fallback engine.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: Broad trigger keywords such as 'error', 'retry', 'api', and 'exception' can cause the skill to activate in many unrelated contexts, increasing the chance it is invoked when the user did not intend it. In an agent ecosystem, overbroad activation can expose logs, alter workflows, or cause unneeded handling behavior to run on sensitive prompts, making the skill context more dangerous than a normal documentation issue.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The manifest trigger phrase 'api error handler' is ambiguous enough to match broad operational discussions rather than a clear request to invoke this skill. In a system with automatic skill routing, ambiguous triggers increase unintended activation risk, which is more concerning here because the skill advertises logging and self-healing ecosystem integration that may affect handling of sensitive error data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The `log` command persists raw error text and arbitrary context directly to `.api-errors.json` without sanitization, minimization, redaction, permission hardening, or an explicit warning to the user. Error messages and context frequently contain API keys, tokens, request payloads, internal URLs, stack traces, or customer data, so writing them to disk can create a local secrets/PII exposure and increase the blast radius of an unrelated compromise.

VirusTotal

65/65 vendors flagged this skill as clean.