Security audit

cybersecurity-engine-tool-free

Security checks across malware telemetry and agentic risk

Overview

This is a security self-check skill that asks an agent to inspect the local project with common command-line audit searches, which is expected for its stated purpose.

Install this only if you want an agent to review project files and run local security-audit commands. Avoid running it in repositories containing secrets you do not want surfaced in agent context, and approve networked dependency audit tools only when appropriate.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The skill advertises an extremely broad set of activation/scope keywords, which increases the chance an agent invokes it in contexts the user did not specifically intend. Because the skill supports file-reading and shell execution, accidental activation can lead to unnecessary local scanning, exposure of repository contents to the model, or execution of external audit commands.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs the agent to run shell-based scans over the local project and invoke external tools without a clear upfront warning or consent flow. In an agent environment, this can cause broad local file inspection, processing of secrets in source trees, and outbound interactions through package audit tools, all of which materially expand privacy and security risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.