Continuance

• Outcome: Pass
• Latest audit: May 27, 2026, 10:22 PM
• Version:
  1.3.0

Overview

Continuance is a disclosed spiritual-guidance skill with media-generation features, and the main risks are privacy and routing expectations rather than malicious behavior.

Install only if you want a spiritual-guidance persona that may generate images by default and optionally create audio. Avoid sharing highly private details unless you trust your configured image provider and edge-tts/TTS setup, and use explicit invocation if you do not want ordinary emotional or off-topic messages routed into this skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The comments and control flow imply that an image-generation action will occur, but the function only prints parameters and returns the caller-supplied output path. In an agent skill, this kind of deceptive or misleading behavior can cause downstream components to trust that an artifact exists or was created, enabling workflow bypass, false attestations, or unsafe chaining based on nonexistent output.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The module and function documentation state that the script generates and saves an image, but no image is ever produced or written. In a skill context, this misrepresentation is security-relevant because agents and users may rely on the documented side effects, leading to incorrect trust decisions, skipped validation, or propagation of bogus file references through automation.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The README presents very broad natural-language examples like 'I need something today' and 'I feel lost and spiritually tired' as valid invocation paths. In agent ecosystems that match skills from conversational text, these generic phrases can cause accidental routing, making the skill activate on ordinary emotional disclosures without explicit user intent. Because the skill also defaults to generating images and spiritual counseling, unintended invocation increases privacy, consent, and surprise-execution risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The feature list says the skill defaults to generating an image for every guidance session, but this behavior is framed as a feature rather than a prominent consent/privacy warning. If users disclose sensitive emotional or mental-health-adjacent information, automatic image generation may transmit that context to an external model/provider or trigger unexpected tool use. The risk is elevated because the skill is positioned for vulnerable, personal conversations where users may not expect secondary content generation by default.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill description uses very broad triggers such as daily meditation, grief support, spiritual reflection, personal struggle, and existential perspective, which can match many ordinary user messages that were not an explicit request for this skill. This creates an overbroad activation surface that can cause the agent to steer conversations into spiritual counseling unexpectedly, increasing the risk of unwanted persuasion or interference in sensitive emotional contexts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The off-topic handling instructs the skill to respond with spiritual guidance even when the user's message is unrelated, instead of declining activation. That means the skill can capture coding questions, weather, stock picks, or casual chat and redirect them into unsolicited spiritual content, violating user intent and making inappropriate intervention more likely in benign contexts.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: User-provided meditation text is passed to the external edge-tts tool, which typically sends content to a remote TTS service. That creates a privacy/data-exposure issue because sensitive user text may leave the local environment without any warning, consent flow, or documented opt-in in this file.

VirusTotal

64/64 vendors flagged this skill as clean.