Norman: Manage Clients

• Outcome: Pass
• Latest audit: May 28, 2026, 2:38 AM
• Version:
  1.0.0

Overview

This is a simple instruction-only skill for managing Norman Finance client records, with no hidden code or install behavior found.

Install this if you want an agent to manage Norman Finance client records. Confirm the connected Norman Finance workspace, review client details before creating or updating records, and be careful when a request mentions generic contacts or customers that may not belong in this client database.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill description includes broad activation terms like "clients, contacts, customers, Kunden" and general database-management phrasing, which can cause the agent to invoke this skill in contexts that only loosely relate to client management. Over-broad routing can expose sensitive customer data or trigger unintended create/update operations when a narrower skill or clarifying question would have been more appropriate.

VirusTotal

65/65 vendors flagged this skill as clean.