Security audit

Life Analyzer

Security checks across malware telemetry and agentic risk

Overview

This is a simple self-reflection prompt skill with no code or hidden access, but it should be used carefully with sensitive personal writing.

Install only if you want an agent to analyze personal reflections or journal-style text. Avoid using it for crisis, self-harm, medical, or mental-health treatment situations, and prefer invoking it explicitly when you want blunt self-improvement feedback.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger conditions are broad enough to match many ordinary conversations about feelings, problems, or reflection, which increases the chance of the skill activating without clear user intent. In this context, unintended invocation is more concerning because the skill performs sensitive psychological-style analysis on personal content and may produce intrusive or overly confident interpretations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly analyzes users' thoughts and journal entries but does not warn users that it may process highly sensitive emotional or mental-health-adjacent content. This is dangerous because users may disclose intimate information without understanding the nature of the analysis, and the skill's 'be honest, not comforting' constraint can amplify harm if users are vulnerable or distressed.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.