Skill Creator 2 0.1.0

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:43 PM UTC
• Version:
  1.0.0

Overview

This is a documentation-only skill that explains how to create skills, with no bundled executable code or hidden data access.

Reasonable to install if you want guidance for building OpenClaw or Claude-style skills. Review any skills produced with it before use, especially any generated scripts or bundled assets, because those future artifacts may carry their own risks.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Self-Modification

High

• Category: Rogue Agent

Content

1. Understand the skill with concrete examples
2. Plan reusable skill contents (scripts, references, assets)
3. Initialize the skill (run init_skill.py)
4. Edit the skill (implement resources and write SKILL.md)
5. Package the skill (run package_skill.py)
6. Iterate based on real usage

• Confidence: 93% confidence
• Finding: write SKILL

Self-Modification

High

• Category: Rogue Agent

Content

Any example files and directories not needed for the skill should be deleted. The initialization script creates example files in `scripts/`, `references/`, and `assets/` to demonstrate structure, but most skills won't need all of them.

#### Update SKILL.md

**Writing Guidelines:** Always use imperative/infinitive form.

• Confidence: 91% confidence
• Finding: Update SKILL

VirusTotal

65/65 vendors flagged this skill as clean.