Microsoft Skill Creator

• Outcome: Pass
• Latest audit: May 28, 2026 at 1:24 PM UTC
• Version:
  1.0.1

Overview

This is a coherent helper for creating Microsoft-focused agent skills, with disclosed documentation lookup and optional CLI use but no hidden or harmful behavior found.

Install this if you want an agent helper for authoring Microsoft technology skills. Prefer the Learn MCP server when available, approve any npx or global npm install explicitly, and review generated skills and sample code before enabling or running them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill's trigger description is very broad, covering creation of skills for nearly any Microsoft technology, library, framework, or service. That can cause the skill to activate in contexts where it is only partially relevant, increasing the chance an agent follows its workflow unnecessarily, performs unneeded external lookups or CLI usage, and overrides more specific safer skills or user intent.

VirusTotal

64/64 vendors flagged this skill as clean.