retire_age

Security checks across malware telemetry and agentic risk

Overview

This is a local retirement-age calculator with one minor privacy/usability issue: it echoes the entered birth year, birth month, and role before printing the result.

Reasonable to install if you need this calculation. Be aware that the command prints the entered birth year, birth month, and role before the JSON result, so avoid using it in logs or automations that assume clean JSON unless that debug output is removed.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

Low

Confidence: 88% confidence
Finding: The function prints user-supplied personal attributes (birth year, birth month, and role) to stdout despite its docstring implying a pure calculation helper. In an agent or automation context, stdout is often captured in logs, which can cause unnecessary disclosure of personal data and make downstream JSON parsing brittle if callers expect only structured output.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal