Math & Statistics Graphing Engine

• Outcome: Pass
• Latest audit: May 29, 2026, 8:28 PM
• Version:
  1.0.0

Overview

This skill is a coherent math graphing helper that uses a declared remote service, with privacy considerations for submitted formulas or datasets.

Install for ordinary math, teaching, and non-sensitive statistical visualization. Avoid submitting confidential business data, regulated records, private student/person-level datasets, or formulas you do not want sent to MathTalking or exposed through an interactive link.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation guidance is broad enough to trigger on common requests like graphing, plotting, visualizing, or verifying results, which can cause the agent to invoke this external skill in situations where the user did not explicitly consent to sending data to a third-party MCP service. Because the skill produces live interactive URLs and may receive user-provided math or datasets, overbroad routing increases the chance of unnecessary external data exposure and unintended tool use.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill declares an external MCP server and later states that all tools return interactive URLs, but it does not clearly warn that user queries, formulas, or datasets are transmitted to a third-party service and exposed through shareable live links. This creates a meaningful privacy and data-handling risk, especially for sensitive educational, research, or business data that a user may assume is processed locally.

VirusTotal

66/66 vendors flagged this skill as clean.