Vivid: Open Business Account

• Outcome: Pass
• Latest audit: May 28, 2026 at 2:38 AM UTC
• Version:
  1.0.3

Overview

This is an instruction-only skill that clearly asks the user to confirm business onboarding details before sending structured data to Vivid's remote service to generate an onboarding link.

Install only if you intend to use Vivid's business onboarding flow. Review the collected-data summary carefully before confirming, verify the country and legal-entity details, upload only documents needed for onboarding, and do not provide passwords, API keys, bank account numbers, or unrelated financial information.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger condition is broad enough that the skill could activate on loosely related requests about business banking or onboarding without a clearly scoped user intent check. Because this skill collects legal-entity information and transmits structured data to an external service, ambiguous activation increases the risk of unintended data collection or external submission.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: Defaulting the country to Germany without explicit user opt-in can cause inaccurate personal or business data to be sent to the remote onboarding service. In an onboarding context, silent assumptions about jurisdiction are risky because they may misroute users, prefill incorrect compliance data, or initiate the wrong onboarding flow.

VirusTotal

66/66 vendors flagged this skill as clean.