get-tldr

• Outcome: Pass
• Latest audit: May 27, 2026 at 9:46 PM UTC
• Version:
  1.0.0

Overview

This skill does what it says: it sends a user-provided URL to get-tldr.com for summarization, while using an API key and keeping a local log that users should be aware of.

Before installing, make sure you are comfortable sending target URLs to get-tldr.com and storing submitted URLs plus returned summaries in a local log. Use a dedicated get-tldr API key, keep config and .env files private, and configure or delete the logfile if the summarized links may contain sensitive query strings or private content.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documentation describes capabilities to read environment variables and local files, write logs, and make network requests, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: a reviewer or runtime relying on declared permissions may underestimate what the skill can access, including API keys in config or environment and filesystem paths.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script logs the full user-supplied URL and the complete API response to a local file, which exceeds the declared behavior of merely relaying and formatting API output. URLs and summaries may contain sensitive query parameters, private resource locations, or confidential content, creating an unnecessary local data retention risk.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The documentation claims the script prints JSON to stdout, but the implementation also persists request and response data to a logfile. This mismatch can mislead users and operators into exposing sensitive URLs or summaries without informed consent, increasing privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill sends user-provided URLs to a third-party service and then stores both the request target and response locally without explicit notice. In this skill context, users expect a relay/format function, so undisclosed transmission and retention make accidental privacy exposure more likely.

VirusTotal

41/41 vendors flagged this skill as clean.