warranty-vault

• Outcome: Pass
• Latest audit: Aug 31, 2026 · 9:33 AM UTC
• Version: 0.1.0

Overview

This skill is a local warranty tracker that stores user-entered purchase details in a JSON file and does not show hidden network, credential, or destructive behavior.

Install only if you are comfortable keeping warranty and purchase metadata in a local plaintext JSON file. Avoid storing full card numbers or highly sensitive receipt contents in notes, consider changing the vault path with --file or protecting it with normal filesystem encryption, and treat generated claim letters as drafts rather than legal advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_cli(args, f):
    return subprocess.run([sys.executable, ENGINE] + args + ["--file", f],
                          capture_output=True, text=True)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

changed = False
    for k in ("name", "category", "receipt", "card", "serial", "notes",
              "extended_by", "registered"):
        v = getattr(a, k, None)
        if v:
            e[k] = v
            changed = True

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

e[k] = v
            changed = True
    for k in ("price", "warranty_mo", "extended_mo", "extended_deductible"):
        v = getattr(a, k, None)
        if v is not None:
            e[k] = v
            changed = True

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This markdown file explains that the tool stores user purchase records in `~/.warranty-vault.json`, which can include receipt references, card type, and warranty-related household data. The description does not include any warning or handling note about privacy implications of keeping this data unencrypted on disk.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use the skill 'when an appliance or device breaks,' 'when you buy anything with a warranty or extended plan,' and 'when doing a household coverage audit,' which are very broad natural-language triggers. Although examples are provided, the manifest does not define narrower invocation constraints or clear exclusion boundaries beyond a few later examples, increasing the chance of unintended activation.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The manifest description states that the skill computes coverage including UK, EU, and US statutory rights by default, which embeds jurisdiction-specific legal behavior into the skill's core operation. While the document later mentions jurisdictions, the top-level description does not clearly limit use to those locales or require the user to choose a jurisdiction before applying locale-specific rules.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: This code stores purchase records, receipt locations, card information, and serial numbers in a local JSON file by default. Although the file write is part of the tool's purpose, the script does not warn users that potentially sensitive personal data will be persisted on disk at a fixed path.

Scope Creep

Low

• Category: Excessive Agency

Content

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def run_cli(args, f):
    return subprocess.run([sys.executable, ENGINE] + args + ["--file", f],
                          capture_output=True, text=True)

• Confidence: 95% confidence
• Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.