store-order-query

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:28 PM UTC
• Version: 1.0.0

Overview

The skill appears to do what it says: it queries a MySQL order database and saves local order/report files, so users should protect the database credentials and generated files.

Install only if you trust the publisher and are comfortable giving the skill access to store order data. Use a dedicated read-only MySQL user, avoid root/admin credentials, keep the local skill-data directory private, delete old orders_data.json and order_report.md files when no longer needed, and lock/audit the installed mysql2 version before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation describes capabilities that access environment-adjacent local resources and sensitive configuration, but it does not declare corresponding permissions or clearly bound those capabilities. This weakens security review and user consent because a skill that connects to a database and handles credentials can operate with more access than its manifest signals.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared purpose says the skill queries store order information, but the workflow also persists raw queried data to disk, reloads it later, performs additional analytics, and writes a report file. This mismatch is dangerous because users and reviewers may authorize a simple live query without realizing the skill creates local data copies of potentially sensitive business records.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill is described as querying store order information, but it also persists the full query results, including order and item details, to a local JSON file. This creates unnecessary data-at-rest exposure because potentially sensitive commercial or customer-related order data remains on disk after the query completes, increasing the chance of unauthorized access by other local processes or users.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code creates a local application data directory and is architected to store database-derived order data on disk, even though the stated purpose is only to query order information from a database. This broadens the skill's data handling scope without clear necessity, creating a secondary repository of sensitive business data that may be less protected than the source database.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly states that raw order data and analysis reports are written to local files, but it does not warn that these outputs may contain sensitive business and potentially customer-related data. In an agent skill context, silent persistence of queried data increases the risk of unintended disclosure through local filesystem access, backups, logs, sync tools, or later reuse by other tools.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger phrases are broad enough to match ordinary business conversation such as asking how today's orders are doing. In context, unintended invocation is meaningful because the skill may connect to a live database and write queried business data to disk without the user explicitly asking for database access or local persistence.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill description does not clearly warn users that it will connect to a live MySQL database, access order records, and write retrieved data and reports to local files. This is dangerous because users may provide credentials or invoke the skill without informed consent about data access, retention, and local storage of potentially sensitive operational information.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Order data is written to a local JSON file without any clear user-facing notice or opt-in regarding persistent storage. This is dangerous because users may reasonably expect a transient database query tool, while the skill silently leaves behind a durable copy of potentially sensitive order records.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.