yyWorldCup

• Outcome: Review
• Latest audit: Jun 17, 2026 · 10:52 PM UTC
• Version: 1.0.6

Overview

The skill mostly matches a World Cup prediction tool, but it also includes under-disclosed maintenance code that can rewrite its own source files and create broad ZIP archives.

Review this skill before installing. Its normal prediction features need internet access and local caching, but avoid running the auto_evolution modules, tune command, or --apply mode unless you intentionally want it to modify code and create archives. A safer version would remove or isolate the auto-evolution, scheduler, embedded API key, and ZIP-generation code from the user-facing prediction skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and demonstrates code paths that read/write local files and access external networks, yet no permissions are declared. That creates hidden capability escalation: a caller or host may invoke a seemingly simple prediction skill that can silently fetch remote data, persist artifacts, or modify local state outside user expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims to provide match prediction and betting analysis, but the analyzed behavior includes autonomous data scraping, backtesting, self-tuning, direct source-code modification, persistence under local evolution directories, packaging, scheduling, and an embedded API key. Those extra behaviors materially expand the attack surface and can enable stealthy code tampering, unauthorized data collection, secret exposure, and persistence mechanisms that a user would not reasonably expect from the stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The module performs actions beyond its stated prediction role by automatically writing evolution metadata and packaging the repository into a zip file. In an agent/skill environment, this broadens the module from analysis into self-modification and artifact generation, which can unintentionally expose unrelated local files or enable unauthorized persistence of generated outputs.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file explicitly implements 'auto evolution' features that go beyond the declared match-prediction purpose, including self-tuning, code rewriting, scheduling, and package generation. In an agent-skill context, hidden maintenance or self-modifying behavior increases the attack surface and can let the skill change future behavior without clear user review.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: AutoParamTuner directly rewrites predictor/core.py based on runtime backtest results using regex substitution, which is effectively self-modifying code. This is dangerous because external or malformed inputs can influence application behavior over time, making the system harder to audit and enabling unauthorized persistence or logic tampering under the guise of model tuning.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The scheduler introduces persistent autonomous execution capability that is not required for one-shot World Cup prediction requests. In an agent environment, unattended scheduled runs can repeatedly access network resources and trigger evolution workflows without a contemporaneous user action, increasing risk if the skill is abused or misconfigured.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Generating versioned ZIP archives and writing evolution logs are maintenance and distribution actions outside the stated prediction function. In a skill context, packaging capabilities can facilitate unauthorized code export, repackaging, or persistence of modified artifacts, especially when combined with self-modifying behavior elsewhere in the file.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code automatically persists fetched match data to local storage without any explicit user consent or warning. In agent contexts, silent writes can create unanticipated retention of user-derived or externally sourced data, increase disk usage, and leave artifacts that later processes may consume or exfiltrate.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The zip generation walks the repository and archives nearly all files, excluding only a few patterns, then writes the package to /tmp automatically. In a skill runtime this can capture secrets, configs, or unrelated local artifacts and consolidate them into an easily transferable bundle, making accidental disclosure significantly more likely.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code path can apply tuning that changes source behavior without a strong user-facing warning or an explicit safeguarded consent flow at execution time. In an agent setting, this undermines transparency and can cause silent state changes that persist beyond the current run, which is risky even if the feature was intended for convenience.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This block writes backup and replacement content directly to predictor/core.py, creating a destructive update path with only minimal safeguards. If triggered unexpectedly or with incorrect substitutions, it can corrupt application logic or persist unsafe behavior, and the backup process itself is not robust enough to guarantee recovery.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.