Bing Wallpaper

• Outcome: Pass
• Latest audit: May 28, 2026 at 9:49 AM UTC
• Version:
  0.1.0

Overview

This skill only fetches the daily Bing wallpaper from a disclosed external API using a small helper script.

Install only if you are comfortable with the skill running its bundled shell script and contacting the disclosed 60s.viki.moe wallpaper API. The reviewed files do not show hidden data access, persistence, destructive behavior, or credential handling.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill instructs the agent to execute a shell script, but the skill declares no permissions indicating shell/code execution capability. This creates a trust and containment gap: reviewers and enforcement systems may treat the skill as lower risk than it really is, while the script can still perform network access and arbitrary shell behavior at runtime. In this context, a wallpaper-fetching skill only needs limited, explicit capabilities, so the undeclared shell execution is more dangerous because it is unnecessary to hide or omit it.

VirusTotal

66/66 vendors flagged this skill as clean.