Security audit

sx-self-safety-guard

Security checks across malware telemetry and agentic risk

Overview

This is a defensive safety skill, but it needs review because some credential-file guidance is too broad and internally inconsistent.

Review the credential-handling sections before installing. Use this only if you are comfortable with a safety skill influencing when agents read secret files, and configure it to require explicit path-level confirmation, masked output, no raw logging, and no broad .env searches unless you deliberately approve them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/prompt-injection-patterns.md:8

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/threat-catalog.md:28

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:99