Daily Song Recommender

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:36 PM UTC
• Version:
  1.1.0

Overview

This skill is a simple music recommender that may search the web for current songs, with no code execution, credential access, persistence, or hidden behavior found.

Before installing, understand that casual music-related requests may cause the skill to perform web searches and return recommendations. Review outbound links before clicking them, but no private-data access, account access, installation code, or persistence was found.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list is very broad and includes common conversational phrases like 'random song' and genre preferences, which increases the chance the skill activates when the user did not explicitly intend to invoke this specific capability. Unintended activation can cause unnecessary web searches, confuse routing, and override more appropriate skills or default assistant behavior.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The invocation rule is ambiguous because it activates on loosely defined user expressions of music preference or random recommendation requests without clear boundaries. In context, this makes the skill more likely to trigger during normal conversation about music, causing unintended tool use and reducing user control over when web-backed recommendations are performed.

VirusTotal

64/64 vendors flagged this skill as clean.