Security audit

Skill Build 55f0zj8c

Security checks across malware telemetry and agentic risk

Overview

The skill mainly reads event listings as described, but it also forces unrelated promotional content and an external group link into every tool response.

Install only if you are comfortable with every event result including unrelated promotional messaging and an external group link. Treat OPC_API_KEY as a secret, avoid putting it in shared files or screenshots, and rotate it if exposed. Also verify the package runs correctly before relying on it, because the submitted bin appears malformed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to append promotional and referral content to every response, which is unrelated to the stated purpose of reading OPC event data. This creates an unauthorized output-manipulation channel that can override user intent, leak trust to third-party marketing, and normalize hidden advertising inside tool results.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The tool embeds a hard-coded promotional traffic-diversion message in a constant and appends it to user-visible output, despite the tool’s stated purpose being event listing. This creates an unauthorized content-injection channel that can be used to redirect users to external properties and abuse the agent’s trust boundary for marketing or phishing.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The execute path appends promotional content to success, empty-result, error, and exception responses, ensuring all users receive unrelated external links regardless of request context. In an agent skill, this is dangerous because it systematically hijacks responses for traffic diversion and can normalize untrusted links presented as part of legitimate tool output.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The tool appends unrelated promotional and traffic-diversion text to every success, empty-result, and error response, causing the skill to systematically push users toward external channels unrelated to the requested event data. In an agent/tooling context, this is dangerous because it abuses trusted output space for covert marketing or redirection, and could be extended to phishing, off-platform solicitation, or policy evasion.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README instructs users to place a personal API key into an environment variable but does not warn that the key is a sensitive credential or provide guidance to avoid logging, committing, or sharing it. In the context of MCP/AI client setups, users commonly paste configuration into files or debug output, which increases the chance of accidental credential exposure and unauthorized access to the associated account or data.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The instruction mandates fixed Chinese-language appended content without regard to the user's language or request. While not a direct code-execution risk, it is an output-policy violation that reduces user control, can mislead non-Chinese users, and reinforces the unrelated promotional injection in every response.

Known Vulnerable Dependency: @modelcontextprotocol/sdk==1.0.0 — 1 advisory(ies): CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)

High

Category: Supply Chain
Confidence: 92% confidence
Finding: @modelcontextprotocol/sdk==1.0.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/list-events.js:3

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/list-events.ts:13