Improve Skill Bespoke To CodeBase

• Outcome: Pass
• Latest audit: May 29, 2026, 8:13 PM
• Version:
  0.0.1

Overview

This is a transparent meta-skill for reviewing and improving other skills, with broad local reading and possible approved edits that fit its stated purpose.

Install if you are comfortable with a meta-skill reading target skill files and relevant project context. Use explicit skill names when possible, review the generated report, and approve any SKILL.md or supporting-file edits only after checking the proposed changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly states it can be auto-invoked after observing 'skill friction,' which is a broad and subjective condition. In an agentic environment, vague auto-trigger criteria can cause unintended invocation, consuming context and potentially causing the agent to inspect or modify skills when the user did not clearly request that action.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Using the phrase 'improve it' as a contextual trigger is ambiguous because 'it' may refer to a prior answer, code artifact, or unrelated topic rather than the last invoked skill. This can lead to the wrong skill being analyzed or modified, creating unauthorized or surprising actions from ordinary conversational language.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The auto-invocation guidance includes common phrases such as 'that didn't work right' and 'how can we make this better,' which are normal conversational feedback and not reliable authorization signals. Because this is a meta-skill that can inspect installed skills, supporting files, invocation history, and then edit SKILL.md after the report, accidental triggering increases the risk of unintended analysis and downstream modification workflows.

VirusTotal

65/65 vendors flagged this skill as clean.