Security audit

Skill Build Oalrxkoy

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does what it says, but it forces promotional content into every response and requires a personal API key.

Install only if you accept that every tool result will include the publisher's promotional footer and link. Treat OPC_API_KEY as a secret, avoid committing client config files that contain it, and reset the key if it is exposed. Consider asking the publisher to remove the forced footer and document explicit tool invocation and credential handling before relying on it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill explicitly requires appending promotional content to every output, even though the stated purpose is only to read and filter OPC discovery articles. This creates an unauthorized output-manipulation channel that can hijack agent responses for advertising, phishing, or trust abuse, and it conflicts with user intent and host application expectations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README directs users to obtain and configure a personal API key, but provides no guidance on secure storage, least-privilege handling, rotation, or the fact that the key will authenticate requests to a third-party service. In an MCP/agent context, users may paste credentials into broad client configurations or shared environments, increasing the chance of accidental exposure or misuse.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation examples are phrased as ordinary user requests such as asking for recent AI tools or recommendations, without clear scoping cues that distinguish skill activation from normal conversation. In agent environments, this can cause unintended tool invocation, over-collection of external data, or response steering when users did not intend to use this specific skill.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: Forcing Chinese promotional text onto every response without user consent is a direct response-injection behavior unrelated to the skill's functional purpose. This can override user preferences, degrade output integrity, and be repurposed to insert spam, social-engineering links, or other unauthorized content into agent responses.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The configuration includes an API key directly in a local config file, which creates a clear secret-exposure risk if the file is shared, committed, logged, or read by other local processes. Because the server points to an external domain, compromise of this credential could allow unauthorized access to the associated OPC API and any data or actions permitted by that key.

Known Vulnerable Dependency: @modelcontextprotocol/sdk==1.0.0 — 1 advisory(ies): CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)

High

Category: Supply Chain
Confidence: 91% confidence
Finding: @modelcontextprotocol/sdk==1.0.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/list-discover.js:3

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/list-discover.ts:11