Threat Modeling Expert

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:25 PM UTC
• Version:
  1.0.1

Overview

This is an instruction-only threat modeling aid with no code, install steps, credentials, persistence, or hidden execution.

Safe to install as an advisory security-planning skill. Use it only for systems you are authorized to review, define the review scope up front, and avoid placing sensitive architecture details in generated threat models unless the agent environment and storage controls are appropriate.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly says to use it proactively for 'security architecture reviews,' which is a broad trigger for a capability that can analyze systems for weaknesses and attack paths. In a security-focused skill this is expected, but without tighter scoping around authorization and approved use, it can encourage unsolicited or insufficiently scoped review activity that may expose sensitive architecture details or normalize analysis outside proper approval boundaries.

VirusTotal

65/65 vendors flagged this skill as clean.