Code Analyzer

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:15 PM UTC
• Version:
  1.0.0

Overview

This skill locally analyzes a user-selected codebase and writes Markdown reports, with no evidence of hidden sharing, credential use, persistence, or destructive behavior.

Install only if you are comfortable running local Python analysis scripts on repositories you choose. Point it at intended project paths, exclude sensitive or irrelevant directories, and review generated reports before sharing them because they can summarize private architecture and business logic.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises and instructs use of scripts that read arbitrary project paths, write analysis reports, and may interact with external references, yet no permissions are declared. Missing permission declarations undermine the platform trust model and can cause users or orchestrators to invoke capabilities without informed consent or appropriate sandboxing.

VirusTotal

65/65 vendors flagged this skill as clean.