Security audit

Qa Agent

Security checks across malware telemetry and agentic risk

Overview

This QA skill is a straightforward local linting and test-running helper with no hidden persistence, credential handling, or exfiltration behavior found.

Install this if you want an agent helper for running local lint and test commands. Treat it like any QA automation: run it only on projects you trust, because tests execute project code, and review any extra flags such as --fix before allowing file changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.13/site-packages/_pytest/_code/code.py:161

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.13/site-packages/_pytest/_py/path.py:1101

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.13/site-packages/_pytest/mark/__init__.py:67

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.13/site-packages/_pytest/mark/expression.py:295

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.13/site-packages/_pytest/pathlib.py:725

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.13/site-packages/_pytest/pytester.py:295

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.13/site-packages/_pytest/skipping.py:92

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.13/site-packages/pip/_vendor/packaging/licenses/__init__.py:100

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.13/site-packages/pip/_vendor/pygments/formatters/__init__.py:91

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.13/site-packages/pygments/formatters/__init__.py:91

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.13/site-packages/pygments/lexers/_julia_builtins.py:150

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.13/site-packages/pip/_internal/network/auth.py:94

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.13/site-packages/pip/_vendor/requests/adapters.py:281

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.13/site-packages/pip/_vendor/requests/sessions.py:322

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.13/site-packages/pip/_vendor/urllib3/connection.py:423

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.13/site-packages/pip/_vendor/urllib3/connectionpool.py:991

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.13/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.py:231

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.13/site-packages/pip/_vendor/urllib3/contrib/socks.py:102

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.13/site-packages/pip/_internal/network/session.py:311

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.13/site-packages/pip/_vendor/truststore/_macos.py:371

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.13/site-packages/pip/_vendor/truststore/_windows.py:458

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.13/site-packages/pip/_vendor/urllib3/connection.py:454

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.13/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py:113

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.13/site-packages/pip/_vendor/urllib3/contrib/securetransport.py:794

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.13/site-packages/pip/_vendor/urllib3/util/ssl_.py:140