S³ Security Audit

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward security-audit skill that scans local project files for vulnerabilities and secrets, with no hidden execution or exfiltration behavior found.

Install only if you intend to audit the current codebase. Run it from the project root you want scanned, review package-install commands before allowing them, and redact or avoid sharing any discovered secrets; rotate credentials if real secret values are exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The skill explicitly instructs enumeration of .env, key, secret, and credential-like files, which can surface highly sensitive material during routine use. While this is normal in a security audit context, the lack of guidance to avoid printing, copying, or storing discovered secrets increases the risk of accidental exposure in logs, transcripts, or downstream outputs.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal