Bug Investigation

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only frontend debugging checklist with no executable code or hidden privileged behavior.

Safe to install as a frontend debugging aid. When using it, share minimal repro steps and sanitized console or network logs; redact cookies, authorization headers, tokens, private response bodies, customer data, and real production credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrases are very broad and map to common user requests like debugging, locating issues, or reproducing bugs, which increases the chance the skill is invoked when the user did not specifically intend to use this workflow. Unintended invocation can steer conversations into a rigid diagnostic process, potentially collecting extra environment details or causing the wrong skill to take precedence over more suitable ones.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal