Ok Computer Swarm

• Outcome: Pass
• Latest audit: May 28, 2026 at 9:55 AM UTC
• Version:
  0.1.0

Overview

This is a straightforward DuckDuckGo search helper that sends user-provided queries to DuckDuckGo, with no evidence of hidden persistence, credential access, or destructive behavior.

Install this only if you are comfortable sending the search queries you provide to DuckDuckGo. Avoid using secrets or confidential internal details as queries, and apply normal Python dependency hygiene because the requests dependency is specified as a lower-bound version rather than a locked package hash.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation indicates the associated script performs DuckDuckGo web searches, which requires outbound network access, yet no permissions are declared. This creates a transparency and policy-enforcement gap: users or hosting platforms may assume the skill is local-only while it can transmit queries to external services, potentially exposing sensitive input and bypassing expected approval controls.

VirusTotal

66/66 vendors flagged this skill as clean.