Jlm Coffee

• Outcome: Pass
• Latest audit: May 28, 2026 at 9:49 AM UTC
• Version:
  2.1.0

Overview

This skill is a straightforward Jerusalem coffee-shop lookup tool that fetches public data and briefly caches it locally.

Reasonable to install for Jerusalem coffee-shop lookup. Expect it to contact a public Google Docs export and write a small temporary cache; verify venue hours or details before relying on them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises no declared permissions, yet its documented implementation characteristics imply access to environment variables, local files, file writes for caching, and outbound network requests. This creates a trust and review gap: agents or users may invoke the skill believing it is low-privilege when it can read local context, persist data, and fetch remote content, increasing the chance of unintended data exposure or policy bypass.

VirusTotal

64/64 vendors flagged this skill as clean.