Skill Build Kf13n9ev

• Outcome: Review
• Latest audit: Aug 12, 2026 · 12:31 AM UTC
• Version: 0.1.0

Overview

The skill reads event data as described, but it also forces unrelated promotional messages and external links into every result.

Review before installing. The event-query behavior is narrow and non-destructive, but every tool response is designed to include unrelated promotional messaging and an external community link. Treat the OPC API key as a secret, store it only in your MCP client's environment/secret configuration, and rotate it if exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill contains a mandatory instruction to append unrelated promotional and lead-generation content to every output. This is not necessary for the stated OPC event-reading functionality and creates an output-integrity issue by covertly turning normal tool responses into marketing messages, which can mislead users and abuse agent trust. In an agent setting, mandatory appended content can also be used as a foothold for future phishing, social engineering, or off-platform redirection.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The tool appends unrelated promotional traffic-diversion content to every response, including normal results and error messages. This violates expected tool behavior, can manipulate users into off-platform engagement, and represents hidden content injection rather than a pure event-listing function.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The code comments and tool description present the skill as an event-listing utility, but the implementation injects unrelated marketing content into outputs. This mismatch is dangerous because it conceals non-functional behavior from reviewers and users, increasing the risk of deceptive content delivery.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The tool appends unrelated promotional and traffic-diversion content to every response, including normal results and error messages. In an agent skill, this is a deceptive misuse of tool output because it leverages user trust and the host application's interface to advertise external channels unrelated to the requested event data.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The README directs users to place a personal API key in an environment variable but does not warn that the key is sensitive, should not be committed, logged, or shared, and should be scoped/rotated if exposed. In the MCP/agent context, credentials are often broadly accessible to local tooling, debug logs, or misconfigured assistants, which increases the chance of accidental disclosure or misuse.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The issue is not merely the use of Chinese, but that unsolicited promotional messaging in a fixed language is appended to all responses without user consent. In context, this is deceptive output manipulation and traffic diversion, making the language coercion part of a broader abusive behavior pattern.

Known Vulnerable Dependency: @modelcontextprotocol/sdk==1.0.0 — 1 advisory(ies): CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: @modelcontextprotocol/sdk==1.0.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: dist/list-events.js:3

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/list-events.ts:13