阅读清单

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:18 PM UTC
• Version:
  1.0.0

Overview

This is an instruction-only reading-list helper that stores reading-list data locally, with no executable code or hidden behavior found.

Before installing, remember that URLs, titles, notes, progress, and reading habits may persist locally. Avoid storing sensitive research topics unless that local file location is acceptable, and preview delete, share, or export actions before confirming them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The skill explicitly states that the reading list is stored persistently in a local file under the user's home directory, but it does not warn users that URLs, titles, notes, or reading habits may be retained across sessions. This can expose personal interests or sensitive research topics to other local users, backups, or later processes that access the workspace.

VirusTotal

64/64 vendors flagged this skill as clean.