Security audit

Booth Script Generator

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only booth script skill with coherent lead-qualification behavior, though users should add consent and privacy language before using its email-capture examples.

Before installing or using this skill in a real event, add your organization's privacy notice and consent script to any email capture, follow-up list, or renewal-trigger workflow. This is especially important for regulated industries or regions with strict marketing and personal-data rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script explicitly tells booth staff to collect work email addresses and add attendees to follow-up workflows without any instruction to obtain explicit marketing consent or provide a privacy notice. In an event-sales context, this can lead to unauthorized processing of personal data and noncompliant outreach, especially under GDPR-style requirements in DACH markets.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The quick-reference card operationalizes adding attendees to follow-up and renewal-trigger lists as a default action, but omits any consent or privacy safeguards. Because this summary is designed for rapid frontline use, staff are even more likely to perform noncompliant data collection and profiling without informing attendees.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.