Gold News Sentiment

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:25 PM UTC
• Version:
  1.0.0

Overview

This skill coherently fetches public gold-related news, analyzes sentiment, and stores local cache files without evidence of hidden credential use, destructive behavior, or unrelated data access.

Install only if you are comfortable with a skill that runs bundled Python scripts to query Google/Bing News and write local cache files for faster future sentiment reports. Treat the output as market analysis support, not financial advice, and enable recurring updates only deliberately with a clear schedule.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill instructs the agent to execute networked scripts and update local files, but the manifest shown does not declare corresponding permissions. That mismatch can undermine permission gating and user/operator expectations, especially for a skill that fetches remote content and writes cached artifacts. In this context the behavior appears functionally intended, but undeclared capabilities increase the chance of silent overreach rather than reflecting a harmless documentation issue.

VirusTotal

64/64 vendors flagged this skill as clean.