Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
- Without declared permissions the skill's intent is opaque and cannot be validated.
Security audit
Hacker News
Security checks across malware telemetry and agentic risk
Overview
This is a read-only Hacker News helper that fetches public HN and Algolia data without credentials, persistence, or destructive actions.
Reasonable to install for Hacker News browsing and search. Ensure curl, jq, and python3 are available, and avoid entering sensitive private terms in searches because queries are sent to external public APIs.
SkillSpector
By NVIDIA
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)
VirusTotal
57/57 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.