Security audit

Ceo Advisor 2

Security checks across malware telemetry and agentic risk

Overview

This CEO-advisory skill is broad and may read local company context, but the artifacts do not show hidden access, credential use, persistence, or harmful behavior.

Install only if you want an agent to use CEO-level business context for strategy and board-style analysis. Keep in mind it may read company-context.md when present, so avoid storing highly confidential company details there unless you trust the skill and runtime environment; also verify the publisher/version because package metadata is inconsistent.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill description is extremely broad and keyed to common executive/business phrases like strategy, planning, leadership, fundraising, and board meetings. In agent-routing systems, this can cause over-invocation in ordinary conversations, exposing unrelated user context to this skill and allowing it to influence workflows outside a narrowly intended scope.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The example trigger 'Help me think about strategy' is so generic that it can match a wide range of everyday requests unrelated to CEO advisory. This increases the chance of accidental routing and unnecessary context access, especially because the skill also instructs reading company-context.md and coordinating with other roles.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.