Bug Bounty

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only bug bounty skill, but it should be reviewed because it encourages website vulnerability scanning without clear authorization or scope checks.

Install only if you will use it for assets you own, lab/CTF environments, or bug bounty programs where testing is explicitly authorized. Before any scan, confirm the target scope, permitted techniques, rate limits, and reporting rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill includes a generic instruction to scan a real domain for common vulnerabilities without any authorization, ownership, or program-scope checks. In a bug bounty context this can prompt unauthorized security testing against third-party targets, increasing the risk of misuse and policy or legal violations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal