Global Nuclear Brief

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:29 PM UTC
• Version:
  0.1.0

Overview

This skill does what it claims: it uses Apify and Contextual API keys to fetch public nuclear-policy news and generate a brief.

Install this only if you intend to use Apify and Contextual for live policy-news briefing. Use scoped API keys where possible, monitor provider usage, avoid confidential information in queries or topics, and do not override the default Apify actor unless you trust the replacement actor.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill clearly depends on environment secrets and outbound network access to Apify and Contextual, but it declares no permissions to reflect those capabilities. This creates a transparency and policy-enforcement gap: an operator may approve or run the skill without realizing it can access credentials and transmit data externally, which increases the risk of unintended secret exposure or unauthorized external calls.

VirusTotal

64/64 vendors flagged this skill as clean.