Validator Agent

• Outcome: Pass
• Latest audit: May 28, 2026 at 11:50 AM UTC
• Version:
  1.1.0

Overview

This is a coherent validator skill, but it can run local project commands, so it should only be used on projects the user trusts.

Install if you want an agent-guided validation checklist that runs project commands. Use it only on trusted repositories, review package scripts and dependencies before execution, confirm the exact project path, and sanitize or simplify the report filename if the project name contains path separators or shell characters.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes generic phrases such as "validate", "validator", and "quality check", which are common in unrelated user requests and can cause the skill to activate outside its intended scope. Because this skill requests the exec tool and is designed to run an automated pipeline, accidental invocation could lead to unintended command execution or disruptive project actions in contexts the user did not explicitly authorize.

VirusTotal

64/64 vendors flagged this skill as clean.