Security audit

Parcel Package Tracking

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Parcel package-tracking helper that discloses its API-key requirement and does not show evidence of hidden or destructive behavior.

Before installing, confirm you trust the publisher with actions available to your Parcel API key. Store PARCEL_API_KEY only in environment or secret storage, do not paste it into chat or commit it, and rotate it if it is exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation states that the skill requires the `PARCEL_API_KEY` environment variable, which means it depends on access to sensitive credentials, yet the skill does not declare corresponding permissions. Undeclared secret access weakens transparency and reviewability, increasing the chance that an agent or user will grant or use credential access without understanding the security implications.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The documentation instructs users to configure an API key but does not include any warning about treating that key as sensitive, avoiding hardcoding, or preventing accidental disclosure in logs, examples, or screenshots. In a skill that invokes a CLI and relies on an environment variable, this omission can lead to insecure operator behavior and credential leakage.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.