Security audit
Toolbelt
Security checks across malware telemetry and agentic risk
Overview
This skill is coherent and disclosed: it sets up Toolbelt only with user consent, stores a workspace token, and persists data the user chooses to upload or share.
Install this only if you want Toolbelt to store and query selected data in an external shared workspace. Approve setup prompts deliberately, protect the generated token and share URLs like passwords, upload only data you intend to persist, and remove the MCP config entry or revoke tokens when you no longer need access.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.