Kimai Time Tracking

• Outcome: Pass
• Latest audit: May 28, 2026 at 9:37 AM UTC
• Version:
  1.0.0

Overview

This is a disclosed Kimai API helper that uses a user-provided Kimai URL and token for time-tracking and related account operations.

Install only if you are comfortable giving the skill a Kimai API token that can read and change time-tracking and business records on your configured Kimai server. Use a least-privilege Kimai token, verify KIMAI_BASE_URL points to your trusted Kimai instance, and require explicit confirmation before any delete or --force operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill explicitly depends on environment variables containing credentials and requires outbound network access to a Kimai instance, but no declared permissions are provided. That creates a governance and trust gap: an agent may be allowed to access secrets and external services without transparent permission scoping or user awareness.

VirusTotal

66/66 vendors flagged this skill as clean.