Tmp.Fw9ukRcLsC

Security checks across malware telemetry and agentic risk

Overview

This SignUpGenius skill is purpose-aligned but should be reviewed because it uses account credentials/session cookies and can make real account changes without explicit confirmation guidance.

Install only if you are comfortable giving an MCP server access to your SignUpGenius account session or credentials. Prefer a project-scoped config, avoid storing your password when fetchproxy or an API key can be used, and manually confirm any add-member or RSVP action before allowing the agent to run it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger description is very broad and includes generic phrases like 'available slots' or 'add [person] to my [group] group', which could cause the skill to activate for loosely related requests without strong SignUpGenius-specific intent. Because the skill has write capabilities, overbroad activation increases the chance of unintended data access or accidental mutations in a user's signed-in account.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill exposes write actions such as adding group members and RSVPing, but the documentation does not instruct the agent to obtain explicit confirmation before performing those mutations. In practice, this can lead to unintended changes to real SignUpGenius groups or event participation if a user request is ambiguous, inferred, or triggered accidentally.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal