HTTP Security Headers

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:37 PM UTC
• Version:
  1.0.1

Overview

This is a straightforward website header scanner that only contacts URLs the user provides and reports security header recommendations.

Install this if you want a tool that contacts websites you specify to inspect response headers. Use it only on domains or systems you own or are authorized to test, and be aware that batch mode will contact every URL supplied.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs users to run a Python script that performs outbound HTTP requests against arbitrary user-supplied URLs, which is a network-capable action. If the skill framework relies on declared permissions for policy enforcement or user consent, omitting that declaration can bypass expected safeguards and enable scanning of internal or sensitive endpoints without clear authorization boundaries.

VirusTotal

64/64 vendors flagged this skill as clean.