Security audit

knitting-pattern-solver

Security checks across malware telemetry and agentic risk

Overview

This skill is a local knitting helper that parses pattern notation and calculates yarn needs, with no hidden network, credential, persistence, or destructive behavior found.

This appears safe to install for local knitting-pattern assistance. Users should understand that it supports standard English knitting abbreviations and should manually verify important yarn or stitch-count results for costly projects, but no sensitive access or automatic action was identified.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: The text states that the parser recognizes abbreviations used across English-language knitting patterns, which imposes a language-specific scope in natural-language documentation. Because no user opt-in or justification for the locale restriction is provided in this file, it may conflict with the policy against forcing a specific language without user choice.

Scope Creep

Low

Category: Excessive Agency
Content: copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
Confidence: 70% confidence
Finding: NOT LIMITED TO

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.