Transcript to Content

• Outcome: Pass
• Latest audit: May 27, 2026, 9:17 PM
• Version:
  1.0.0

Overview

This skill is a coherent transcript-to-training-materials workflow with disclosed local file reads and optional deliverable creation, but users should keep its source folder and output paths scoped.

Use this skill only on the transcript or project folder you intend to process, especially if the materials contain private meeting, HR, customer, or training data. For branded presentations, confirm where generated files and copied logos will be written so existing files are not overwritten, and remove external font links if you need fully offline or sensitive deliverables.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file explicitly instructs the agent to use 'Chain of Thought processing,' which encourages generation or handling of hidden intermediate reasoning that is not necessary for transcript structuring. In an agent skill, this increases the risk of reasoning leakage, inadvertent disclosure of internal analysis, and prompt-surface expansion beyond the requested output.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The top-level description is very broad and can cause the skill to activate for many generic transcript or note-processing tasks without clear limits. Over-broad activation increases the chance the agent applies this workflow in unintended contexts, leading to unnecessary file access, reference-file reads, or output generation that the user did not explicitly request.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The 'When to Use This Skill' criteria are expansive and lack constraints, exclusions, or user-confirmation checkpoints. In an agentic environment, this can cause the skill to engage on ordinary meeting content and perform broader analysis or file operations than necessary, increasing the risk of unintended data handling.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to copy a user-supplied logo into the project directory, which is a local file modification, without prior notice, consent, or safer handling guidance. Silent writes can overwrite files, alter repositories, or introduce untracked artifacts into working directories, especially if paths are user-controlled or ambiguous.

VirusTotal

64/64 vendors flagged this skill as clean.