Project Manager Skill

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:39 PM UTC
• Version:
  1.0.0

Overview

This is a prompt-only product analysis skill that does not request code execution, credentials, persistence, or sensitive local access.

Installers should expect this skill to shape product-review requests into a bilingual structured analysis format. The main caveat is that its triggers are broad, so it may activate for general product research or review requests; review any separate tools the agent chooses to use for live research, since this skill itself does not request those capabilities.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill's trigger description includes very broad activation phrases such as 'research', 'review', 'analyze', and 'evaluate [product]'. In an agent routing context, these generic verbs can cause the skill to activate for many unrelated user requests, leading to overbroad interception, unintended prompt influence, and misrouting of tasks into this skill when a more appropriate or safer skill should handle them.

VirusTotal

66/66 vendors flagged this skill as clean.