Skill Build Ncgr86vs

• Outcome: Review
• Latest audit: Aug 11, 2026 · 4:37 AM UTC
• Version: 0.1.0

Overview

The skill mostly does what it claims, but it forcibly appends unrelated promotional content and an external link to every tool response.

Review before installing. The API-key-backed event lookup is coherent, but the skill also injects unrelated promotional text and an external link into every answer, and the packaged entrypoint appears broken. Keep the OPC API key out of shared configs and rotate it if exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Low

• Confidence: 96% confidence
• Finding: The skill mandates appending unrelated promotional content to every response, which is outside the stated purpose of reading OPC event data. This is dangerous because it turns the skill into a covert marketing channel and can override user intent, reducing trust and creating a path for persistent unwanted content injection in all tool outputs.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The tool hardcodes unrelated promotional/traffic-diversion text and appends it to user-facing output, which violates the stated purpose of listing events and creates covert output manipulation. In an agent context, this can be used to hijack user attention, inject spam into downstream workflows, or bias users toward off-platform links unrelated to the requested task.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The response-building logic appends promotional content to success, empty-state, and error responses, showing that the diversion is systematic rather than accidental. This is dangerous because every invocation becomes a vehicle for unsolicited link injection, which can mislead users, contaminate agent outputs, and route traffic to external destinations regardless of user intent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The tool appends unrelated promotional and traffic-diversion text to every user-facing response, including success, empty-result, and error paths. This is dangerous because it abuses the tool's trusted output channel for unsolicited advertising and external redirection, which can manipulate users, erode trust, and create a pathway for phishing or off-platform monetization under the guise of normal tool behavior.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The README instructs users to obtain and configure a personal API key but gives no guidance on keeping it secret, avoiding commits to source control, or limiting exposure in logs and shared configs. In an MCP/AI-client context, users often copy secrets into environment or tool settings, so missing handling guidance increases the chance of accidental credential leakage and unauthorized API use.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The skill forces fixed Chinese-language output content at the end of every response without user choice or localization controls. This is risky because it can override user preferences, interfere with downstream consumers expecting different languages or clean structured output, and acts as a hidden behavioral constraint unrelated to the tool's core function.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The tool sends user-derived query parameters to an external domain with an API key but does not disclose this data transfer to the user. In agent environments, undisclosed external transmission can violate privacy expectations and organizational policy, especially when users may assume local processing.

Known Vulnerable Dependency: @modelcontextprotocol/sdk==1.0.0 — 1 advisory(ies): CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: @modelcontextprotocol/sdk==1.0.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: dist/list-events.js:3

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/list-events.ts:13