Security audit

tool-selector

Security checks across malware telemetry and agentic risk

Overview

This skill is a local DIY planning helper with proportionate scripts and no hidden access, though users should treat its electrical, plumbing, mounting, and tool-substitution advice as planning guidance rather than professional safety instruction.

Before installing, understand that this is a planning aid for ordinary DIY projects, not professional construction, electrical, plumbing, structural, or code-compliance advice. Use PPE, follow manufacturer instructions, verify power/water is off where relevant, check wall contents and load ratings before drilling or mounting, and consult a licensed professional for electrical, gas, structural, or uncertain plumbing work.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README provides actionable DIY project guidance involving tools, cutting, drilling, and installation, but lacks a clear general safety warning about personal injury, electrical/plumbing hazards, structural risks, and the need for protective equipment. Because this skill is explicitly meant to guide inexperienced DIY users, omission of safety guidance can increase the chance of unsafe tool use, property damage, or injury.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The reference file explicitly includes 'Plumbing Basics' and 'Electrical Basics' as common DIY project categories without any adjacent safety caveats, qualification limits, or direction to shut off power/water and defer to licensed professionals for higher-risk work. In the context of a tool-selection skill meant to guide home repair projects, this omission can normalize hazardous tasks and lead users to attempt unsafe work with incomplete risk awareness.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This skill provides actionable electrical-installation instructions for a ceiling fan, but it does not present a prominent upfront warning or gating message about the risk of shock, fire, code violations, or the need to stop if the user is uncertain. Although some safety notes exist in the steps and metadata, the skill context is consumer DIY guidance, so incomplete risk framing can contribute to unsafe real-world actions.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The TV wall-mount guidance includes some safety advice, but it lacks an explicit upfront warning that improper mounting can cause the TV to fall, injure people, or damage walls and wiring. In a DIY-planning skill, users may treat the output as authoritative, so underemphasized risk disclosures can increase the chance of unsafe execution.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script is explicitly designed to recommend substitute tools, including potentially hazardous or code-sensitive tasks, but it provides no global safety disclaimer or boundary stating that substitutions may be unsafe for structural, electrical, plumbing, automotive, or other regulated work. In this DIY skill context, users may treat the recommendations as authoritative and attempt risky substitutions without understanding injury, equipment damage, or code-compliance implications.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The fallback path gives broad functional substitution advice such as 'cutting → different saws, knives, or abrasive tools' without any qualification about task suitability, PPE, material compatibility, or hazard level. Because this skill is meant for DIY planning, that generalized guidance can encourage unsafe improvisation with unfamiliar tools, increasing the risk of personal injury or property damage.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.