Clipboard Stash Demo

• Outcome: Pass
• Latest audit: May 26, 2026, 9:58 PM
• Version:
  0.1.0

Overview

This is a simple local clipboard helper that stores user-provided snippets in one disclosed plaintext file, with a scoped but irreversible clear-all command.

Install only if you are comfortable with snippets being saved in plaintext at ~/.cache/clipboard-stash/stash.tsv until deleted. Do not store passwords, tokens, private keys, or sensitive personal data, and use the clear-all command carefully because it erases the entire stash.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents a destructive command that truncates the entire stash file with no warning, confirmation step, or scoped-delete alternative. In an agent setting, a mistaken invocation or prompt misunderstanding could irreversibly erase all persisted snippets in the user's workspace.

VirusTotal

64/64 vendors flagged this skill as clean.