Course Schedule Export

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent timetable-to-calendar helper that reads user-provided schedule data and writes a local .ics file, with no evidence of hidden network access, credential use, persistence, or destructive behavior.

Before installing, be aware that the skill can run included local Python scripts over timetable data and write a calendar file. Use it with manifests and output paths you intend to process, and remember that class schedules may contain private location or attendance details.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill instructs the agent to read reference files and run scripts that generate output files, which implies file read/write capability, but no permissions are explicitly declared. This can lead to an agent being granted or assuming broader filesystem access than reviewers expect, increasing the risk of unintended data exposure or modification on the local machine.

VirusTotal

48/48 vendors flagged this skill as clean.

View on VirusTotal