E-commerce Data Scraper Pro

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  1.0.1

Overview

This is a straightforward user-run web/API scraping skill with expected network and file access, but users should handle credentials, scraping permissions, and unpinned dependencies carefully.

Install it in a virtual environment, pin or lock dependencies if you need reproducible installs, and only scrape sites you are allowed to access. Avoid collecting sensitive personal data, use scoped temporary API tokens with --auth, and choose output paths intentionally because the tool will create parent directories and write results there.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises executable capabilities such as file read, file write, and network access, but does not declare any permissions or trust boundaries. This creates a transparency and governance gap: users or the host platform cannot accurately assess what the skill may access or transmit before use, increasing the risk of unauthorized data access or exfiltration.

VirusTotal

66/66 vendors flagged this skill as clean.