Wine Info Search

• Outcome: Review
• Latest audit: Jul 9, 2026 · 7:37 AM UTC
• Version: 1.7.0

Overview

This read-only wine lookup skill mostly matches its purpose, but its optional Firecrawl mode can automatically send the API key over an unverified TLS connection despite contradictory safety claims.

Install only if you are comfortable with read-only wine queries being sent to external services. Avoid configuring FIRECRAWL_API_KEY until the Firecrawl TLS fallback is fixed, and avoid optional OCR dependencies or upgrade Pillow before processing untrusted label images.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tainted flow: 'req' from os.environ.get (line 879, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

setattr(insecure_ctx, "check_hostname", False)
            setattr(insecure_ctx, "verify_mode", getattr(ssl, "CERT_NONE"))
            try:
                return urllib.request.urlopen(req, context=insecure_ctx, timeout=timeout)
            except Exception:
                pass  # Fall through to raise original error

• Confidence: 98% confidence
• Finding: On SSL or timeout errors, the Firecrawl helper retries the API request with certificate verification and hostname checking disabled, while still sending the Authorization bearer key. That enables man-in-the-middle interception or tampering of credentialed API traffic, directly contradicting the surrounding security claims.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no permissions while its documented behavior clearly depends on environment-variable access and outbound network calls. This undermines least-privilege review and can cause the host agent to invoke a networked, credential-consuming skill without transparent permission gating, increasing the chance of unintended data exposure or policy bypass.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill repeatedly emphasizes that no sensitive credentials are required for core functionality, yet an important data path uses a bearer-token authenticated third-party scraping service. This mismatch can mislead users and orchestration systems about the sensitivity of execution, causing secrets to be supplied or transmitted to external services under a lower-risk assumption than warranted.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation asserts bearer tokens are never sent over unverified TLS, but the implementation explicitly retries Firecrawl requests with verification disabled. Misleading security assurances are dangerous because operators may trust the skill's handling of secrets and deploy it in hostile network environments.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This section explicitly recommends sending user search queries and Vivino target URLs to Firecrawl, a third-party scraping service, but does not document any consent, disclosure, minimization, or privacy warning. Even in a read-only skill, user-entered wine queries, inferred interests, and fetched URLs are externally transmitted, creating a data-sharing and privacy-risk gap rather than a direct system-compromise issue.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: This block silently falls back to an SSL context with CERT_NONE and disabled hostname checks for Firecrawl API calls, which include the bearer API key. Because the downgrade occurs automatically and without an execution-time warning, users may unknowingly expose credentials and accept tampered responses.

Known Vulnerable Dependency: Pillow==11.2.1 — 9 advisory(ies): CVE-2026-42309 (Pillow has a heap buffer overflow with nested list coordinates); CVE-2026-25990 (Pillow affected by out-of-bounds write when loading PSD images); CVE-2026-42311 (Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)) +6 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The requirements file pins Pillow to a version flagged by multiple high-severity advisories, including memory-corruption issues in image parsing. In this skill, OCR and label-photo recognition increase relevance because untrusted user-supplied wine label images may be processed, making crafted image exploitation more plausible than in a purely text-only tool.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.