Circos Plot Generator

• Outcome: Review
• Latest audit: May 29, 2026, 9:30 PM
• Version:
  1.0.0

Overview

The packaged skill is a manuscript anonymizer, but its registry name advertises a Circos plot generator, so users should review it before installing.

Install this only if you want a blind-review manuscript anonymizer, not a Circos plot generator. Run it on copies of manuscripts, verify the output path before execution, install DOCX support deliberately, and manually review text, metadata, figures, and supplemental files before submission.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation explicitly instructs users to run a local Python script that reads manuscript files and writes sanitized output, but it declares no permissions for those file operations. This creates a trust and audit gap: an orchestrator or reviewer may treat the skill as lower-privilege than it actually is, increasing the chance of unintended file access or overwrite when the packaged code is executed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

docx

• Confidence: 95% confidence
• Finding: docx

VirusTotal

39/39 vendors flagged this skill as clean.