OpenAI Developer Docs

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward OpenAI documentation lookup helper with disclosed network use and minor metadata gaps, not hidden or destructive behavior.

Install this if you are comfortable with a helper script making documentation queries over the network. Keep the default OpenAI MCP endpoint unless you trust an override, do not include secrets or private project data in search queries, and make sure curl and jq are available.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill explicitly instructs the agent to execute shell commands via a local wrapper script, but the metadata shown does not declare permissions for shell access. This creates a capability/permission mismatch that can bypass expected review controls and lead to unintended command execution or network access when the skill is invoked.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal