NBA game schedule today, scores and standings rank.

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:32 PM UTC
• Version:
  1.0.2

Overview

This is a straightforward NBA scores and standings skill that fetches public sports data when used.

Before installing, understand that the skill makes live outbound requests to NBA and StatMuse when used. It does not need credentials or install dependencies, but results depend on external site availability and the StatMuse parser may break if their page layout changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to fetch data from external URLs (NBA CDN, StatMuse, NBA.com), which is network-capable behavior, yet no permissions are declared. That mismatch is a real security and governance issue because it bypasses least-privilege expectations, reduces auditability, and may allow unreviewed outbound requests to third-party services.

VirusTotal

65/65 vendors flagged this skill as clean.