App Builder

• Outcome: Review
• Latest audit: May 28, 2026, 4:36 AM
• Version:
  1.0.0

Overview

This app-building skill has a legitimate deployment purpose, but it appears to tell the agent to bulk upload local environment secrets to Vercel without enough review or scoping.

Review this skill before installing if your projects contain real credentials in .env files. Only use it when you intentionally want deployment help, and confirm exactly which environment variables should be uploaded to Vercel rather than allowing a whole .env file to be copied blindly.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill description is broadly scoped to common software-development tasks like creating, modifying, fixing, and deploying apps, which makes it likely to activate in many routine requests. Overbroad activation can cause the agent to invoke a high-privilege skill unnecessarily, increasing the chance of unintended repository changes, deployments, or use of sensitive tooling without sufficient user intent confirmation.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The instruction to push environment variables from the local `.env` file to Vercel encourages transmission of secrets without an explicit warning, review step, or scoping guidance. This can lead to accidental disclosure of credentials, API keys, development-only secrets, or unrelated local environment values to a third-party deployment platform.

VirusTotal

64/64 vendors flagged this skill as clean.