Security audit

Verifier Skill Generator

Security checks across malware telemetry and agentic risk

Overview

This is a small instruction-only skill for creating reusable project verification helpers, with repository inspection and file creation aligned to that purpose.

Before running it, expect the agent to read project structure and write verifier skill folders into the repository. Review the generated files, especially any authentication, cleanup, or self-update instructions, before committing them or supplying secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The skill states it will generate verifier skill folders in the repository, but the description does not clearly warn users that it will write new files and modify the repo. This can lead to unexpected repository changes, accidental commits, or execution of downstream tooling against newly created content without explicit user awareness.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The default prompt is overly broad: 'Inspect this project and generate verifier skills for the relevant web, CLI, or API surfaces.' This can cause the skill to activate for a wide range of generic project-inspection requests, increasing the chance of unintended invocation and unnecessary exposure of repository context or automated security-related actions in situations where the user did not explicitly request verifier-skill generation.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.