Skylv Dependency Updater

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:40 PM UTC
• Version:
  1.0.0

Overview

This is an instruction-only dependency maintenance skill whose update behavior is disclosed and aligned with its purpose.

Install this if you want an agent to help check and update project dependencies. Review the generated report and changelogs before allowing changes, confirm it is operating in the intended repository, and keep updates separated so they can be tested and reverted if needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad enough to match routine maintenance requests such as 'update dependencies' or 'check for updates', causing the skill to activate in many common contexts. Because the skill proposes package-management commands that can modify project state and introduce supply-chain risk, overly broad invocation increases the chance of unintended execution or acting on ambiguous user intent.

VirusTotal

65/65 vendors flagged this skill as clean.