file-batcher-tool

• Outcome: Review
• Latest audit: May 29, 2026, 9:23 PM
• Version:
  1.0.0

Overview

This skill performs useful local file batching, but it can rename, move, and delete many files without enough warning or safeguards.

Review before installing. Use only on backed-up or test folders, avoid broad paths like home or Downloads unless you explicitly intend bulk changes, and require a preview plus confirmation before rename, organize, or convert operations. Be especially cautious with image conversion because this version removes the original files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README promotes batch rename and auto-organize features that can change filenames and move files in bulk, but it does not warn users that these are destructive filesystem modifications. In an agent skill context, unclear documentation increases the chance of accidental mass changes, data disorganization, broken references, or loss of access to files when invoked on broad paths like Downloads or home directories.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger text includes broad activation cues like 'organize files' or wanting to process multiple files, which can cause the skill to run in contexts the user did not clearly intend. For a skill that performs batch filesystem actions, overbroad triggering increases the risk of unintended destructive or privacy-impacting operations on user files.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill describes bulk rename, conversion, and organization commands without warning that these actions can overwrite files, break references, or reorganize important directories in irreversible ways. In a batch-file context, missing safety warnings and confirmations materially increases the chance of accidental data loss or operational disruption.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The convert operation deletes the original image immediately after conversion with `rm "$file"` and provides no confirmation, backup, dry-run mode, or failure validation beyond command chaining. In an agent context, this can cause unexpected and irreversible data loss if the user did not intend destructive conversion, selected the wrong folder, or the output format is unsuitable.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Batch rename performs bulk in-place renames across all files in a directory without preview, confirmation, collision checks, or rollback support. A mistaken pattern or unexpected filenames can rename many files at once, potentially breaking references, workflows, or causing data loss through overwrites and name conflicts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The organize command moves files in place into category folders without warning, preview, or confirmation, which can unexpectedly alter directory structure and disrupt applications or user workflows that depend on current paths. Because this happens in bulk, a mistaken target folder can relocate many files at once and be tedious to undo.

VirusTotal

66/66 vendors flagged this skill as clean.