Learning Assistant App

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 1.0.0

Overview

This appears to be a real learning app, but it needs Review because its calculator can run submitted text as server code and its data APIs can expose or delete saved history.

Install only after reviewing or fixing the server code. Replace eval with a safe math parser, keep the server bound to localhost, remove or restrict broad CORS, and do not enter sensitive text unless you are comfortable sending it to third-party APIs and storing it in local history. Treat the export/import/clear data routes as local admin functions and protect or remove them before exposing the app on a network.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill declares no permissions, yet its documented behavior clearly requires environment-variable access and outbound network connectivity. This is a real security transparency issue because users and platforms cannot accurately assess the trust boundary or data exposure risk before installation or execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented purpose is a simple learning assistant, but the analyzed behavior includes local persistence, history/favorites management, data import/export, clearing local data, usage analytics, and arbitrary expression evaluation via eval. This mismatch is dangerous because it hides materially broader capabilities, including potentially code-execution-like behavior and unannounced handling of user data.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: This API exposes bulk data export, import, and full deletion operations without any visible authentication, authorization, or scope restriction. In a learning assistant context, these endpoints enable unauthorized disclosure, tampering, or destruction of all stored user data, which is more dangerous because the file appears to manage application-wide state rather than per-user isolated records.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The dedicated /clear endpoint performs wholesale data deletion and has no visible access control, tenancy checks, or safety gates. If reachable by an untrusted caller, it allows trivial denial of service and permanent loss of user data, which is context-inappropriate for a study helper application.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The calculator endpoint passes user-controlled input directly to JavaScript eval(), which enables arbitrary code execution in the server process, not just math evaluation. An attacker can execute system commands, read environment variables and local files, or pivot further depending on runtime permissions, making this far more dangerous than a normal calculator feature and not justified by the app's stated purpose.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The markdown advertises translation and other API-backed features but does not warn that user-supplied content may be sent to third-party services. This creates a privacy and data-handling risk because users may enter sensitive text without realizing it leaves the local app boundary.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The skill states that user preferences are stored on the local file system but does not clearly warn about local persistence or retention. While lower severity than remote exfiltration, this can still surprise users and expose data to other local users, backups, or unintended reuse.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code stores search queries and results to disk in cleartext without any indication of consent, minimization, or protection. Search history can contain sensitive personal, educational, or account-related data, and local persistence increases exposure to other local users, backups, or compromised hosts.

Known Vulnerable Dependency: express==4.18.2 — 2 advisory(ies): CVE-2024-43796 (express vulnerable to XSS via response.redirect()); CVE-2024-29041 (Express.js Open Redirect in malformed URLs)

Low

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: express==4.18.2

Known Vulnerable Dependency: axios==1.6.0 — 10 advisory(ies): CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars); CVE-2026-25639 (Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: axios==1.6.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: server.js:74

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: server.js:7