Eudic Vocab

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:15 PM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed Eudic vocabulary helper, but users should handle the API token carefully and treat delete commands and cron setup as real account-changing automation.

Install only if you want Eudic vocabulary automation. Store the Eudic token privately, avoid putting it in shell history or shared cron files, keep quiz output in a private directory, and double-check word IDs before using delete commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation describes capabilities that handle environment-stored credentials, write files via cron/logging/workflow setup, and access an external API, yet it declares no permissions or trust boundaries. This can mislead users and hosting platforms about what the skill will access, reducing informed consent and making misuse of tokens or local system resources harder to detect.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs users to delete learned words from the vocabulary list but does not warn that this is a destructive action or explain whether deletion is reversible. Users may unintentionally lose study data or curated vocabulary state, especially if automation is used after quizzes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation tells users to obtain, store, and pass an API token but provides no guidance on secure credential handling. Tokens placed directly on the command line or in insecure config files can be exposed through shell history, process listings, logs, or accidental commits, enabling unauthorized access to the user's Eudic account data.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script writes both quiz content and a separate answer-key file to disk without warning the user or protecting the files. On shared systems, in multi-user cron environments, or when output paths are predictable, this can leak study history and correct answers, undermining privacy and the integrity of the quiz workflow.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The delete action performs an irreversible remote API deletion immediately when --word-id is supplied, with no confirmation prompt, dry-run mode, or safeguard against accidental invocation. In a CLI that manages a live vocabulary database, this increases the chance of unintended data loss from user error, automation mistakes, or prompt/agent misuse.

VirusTotal

65/65 vendors flagged this skill as clean.