营销日历

• Outcome: Pass
• Latest audit: May 28, 2026 at 9:26 AM UTC
• Version:
  1.0.0

Overview

This skill is a narrowly scoped Eqxiu marketing-calendar helper that fetches public calendar data and creates Eqxiu template search links.

Install this if you want an agent to answer future Eqxiu marketing-calendar questions by contacting Eqxiu's public API. Be aware that date and month queries are sent to msearch-api.eqxiu.com, and do not rely on this skill for legal holiday advice, personal calendars, or historical lookups.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill explicitly requires HTTPS access to msearch-api.eqxiu.com and instructs the agent to execute Python scripts that perform network requests, yet the skill metadata does not declare any corresponding permissions. This creates a transparency and policy-enforcement gap: a host may allow the skill to run without clearly surfacing or gating its outbound network access, which can undermine least-privilege controls and user expectations.

VirusTotal

65/65 vendors flagged this skill as clean.