Security audit
Tmp.I5Yestj4Qu
Security checks across malware telemetry and agentic risk
Overview
This skill is a clearly disclosed, read-only Tock restaurant discovery integration, but it depends on a third-party MCP package and a signed-in browser extension.
Install only if you are comfortable letting this MCP and the fetchproxy extension make read-only Tock requests through your signed-in browser tab, including viewing your Tock profile and reservations when you ask for account tools. Review the external npm package and browser extension source before using it with an account you consider sensitive.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.