Pilot Backup Disaster Recovery Setup

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

This is a coherent backup and disaster-recovery setup recipe, but users should add their own security controls for backup transfer and storage.

Before installing, review the pilot-* skills it installs and run this first in a test environment. For real backups, require encrypted transport and encrypted archives, restrict exposed ports to trusted peers, verify checksums or signatures, define retention/deletion rules, and avoid sending production databases or credentials to restore testers unless that environment is isolated and access-controlled.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill directs transfer of compressed backup archives and restore data between multiple hosts, but it provides no warning or requirement for transport security, authentication, encryption at rest/in transit, or sensitivity handling. Because backups often contain full datasets, credentials, and personal data, undocumented cross-host transmission materially increases confidentiality and integrity risk in a disaster-recovery workflow.

VirusTotal

66/66 vendors flagged this skill as clean.