Security audit
Shipcheck
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed pre-publish leak-checking skill; the main caution is that it installs an external npm CLI and may surface sensitive findings in scan output.
Install only if you trust the @symbolstar/shipcheck npm package. Run it on the specific project you intend to publish or share publicly, avoid pasting raw scan output into untrusted places, and rotate any real credentials it discovers.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
61/61 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.