Security audit
extract-entities
Security checks across malware telemetry and agentic risk
Overview
The skill’s purpose is coherent, but its required shell command formatting can let specially crafted input escape the text wrapper and run unintended shell commands.
Review this skill before installing. It should use a safer way to pass text to `zerogpu extract_entities`, such as a collision-resistant delimiter, stdin/file input, or structured argument escaping. Avoid using it on untrusted arbitrary text until that command-formatting issue is fixed.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.