Live Stream Script Tool Free

• Outcome: Review
• Latest audit: Jul 23, 2026 · 4:31 PM UTC
• Version: 1.0.0

Overview

This skill appears to be a livestream script generator, but it asks for broader agent authority and contains contradictory instructions about when it should run and whether it uses networked LLM services.

Review this skill before installing. It does not show malicious code, but it should be narrowed to livestream script generation, clarify whether prompts may leave the local machine through the agent LLM, and remove or tightly document write/exec and import/reset/export behavior before routine use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill states the free edition does not support data analysis, yet its trigger condition says to use it for data analysis, report generation, statistical insights, and visualization. This inconsistency can cause the agent to invoke the skill in unintended contexts, producing misleading outputs or encouraging users to rely on unsupported functionality.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The document claims the skill works offline with local inference, but later marks an LLM API as required and includes network error handling. Conflicting execution assumptions can mislead operators about data flow and trust boundaries, increasing the risk of sensitive prompts being sent over the network when users expect local-only processing.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill advertises broad operations such as create/query/export, modify/reset/import, and save/convert that go beyond simple script generation. In combination with declared write and exec tools, this overbroad scope can justify unsafe file or system-affecting actions not clearly necessary for the stated purpose.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger condition is materially unrelated to the skill's stated purpose, saying it should be used for data analysis, reporting, statistics, and visualization. Overbroad or mismatched triggers can cause inappropriate activation, especially in agents that auto-select skills, leading to misuse of write/exec-capable tooling in contexts the user did not intend.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation mentions save/import/export/modify/reset operations without warning users that these actions may affect local files or persistent state. Given the skill declares write and exec capabilities, the absence of clear consent and safety boundaries raises the risk of unintended data modification or destructive actions.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.