Security audit

estimate-effort

Security checks across malware telemetry and agentic risk

Overview

This skill provides a transparent workflow for estimating software development effort and only asks the agent to read relevant project files for that purpose.

Install this if you want a Chinese-language effort-estimation workflow that may inspect relevant repository files before producing hour estimates; avoid invoking it casually in repositories where code context should not be read.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger list includes broad terms such as '排期', '预估时间', and 'sprint planning' that can appear in ordinary project discussion, making accidental invocation plausible. In an agent environment, unintended activation can cause the skill to inspect repository structure and related files when the user did not explicitly request that behavior, increasing the risk of over-broad context access or disruptive workflow hijacking.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The skill content and required output format are written entirely in Chinese and prescribe Chinese-language workflow/output without checking the user's language preference. This can cause misunderstanding of prompts, hidden consent issues around repository analysis, and degraded usability or incorrect execution when the surrounding session is in another language.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.