D4 World Boss Tracker

• Outcome: Pass
• Latest audit: May 28, 2026 at 9:44 AM UTC
• Version:
  1.0.3

Overview

This skill appears to fetch public Diablo 4 world-boss timing data and optionally create user-requested reminders.

Before installing, be comfortable with the skill making a public web request to map.caimogu.cc and creating cron-based reminders only when you ask for them. Check any reminder entries so you know when they run and how to remove them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill invokes a shell command (`cd ... && python3 scripts/fetch_boss.py`) but does not declare any permissions, which creates a transparency and policy-enforcement gap. Even if the current command appears simple, undeclared execution capability makes it harder for the platform and users to assess what the skill can do and increases risk if the script is later modified to perform broader actions.

VirusTotal

66/66 vendors flagged this skill as clean.