Security audit
Pass Secrets
Security checks across malware telemetry and agentic risk
Overview
This skill is a password-store helper, but it is too environment-specific for public install because it hardcodes a GPG recipient and operates on the user's local secret store.
Review this before installing. Only use it if you intentionally want the agent to interact with your local pass store, and do not store secrets using the hardcoded GPG recipient unless you have verified that the private key is under your control. Be aware that retrieval and env export commands can print secrets into the agent session or shell history/logs.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
VirusTotal findings are pending for this skill version.
Static analysis
No suspicious patterns detected.