Discovery

• Outcome: Review
• Latest audit: Aug 17, 2026 · 10:43 PM UTC
• Version: 0.2.166

Overview

This appears to be a real data-analysis integration, but it also gives an agent account-login, API-key, payment, purchase, and subscription powers that need review before installation.

Install only if you want an agent to send datasets to Disco and potentially manage a Disco account. Use private visibility for confidential data, do not upload sensitive personal/regulated/business data to public runs, keep the API key in a secret store, and require explicit human approval outside the agent before entering OTPs, attaching payment methods, buying credits, or changing subscriptions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill uses sensitive capabilities (environment access for API keys and outbound network access) but does not declare permissions or clearly constrain them. In an agent ecosystem, this weakens security review and user consent because the skill can access secrets and transmit data externally without an explicit permission boundary.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The advertised purpose is data discovery, but the skill also includes account recovery, API-key issuance, billing, payment-method setup, and credit purchase flows. That broader behavior expands the trust boundary substantially: a user invoking an analytics skill may unintentionally expose email addresses, authentication tokens, billing metadata, or payment actions beyond what the description implies.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The OpenAPI spec exposes account, organization, API-key, and billing-related operations that go beyond the stated purpose of tabular pattern discovery. In an agent setting, this expands the action surface from analysis into account administration, increasing the chance of unintended sensitive actions or abuse if the agent is prompted to manage credentials, plans, or billing.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The API includes credit purchase and subscription-changing endpoints, which enable real financial transactions not disclosed by the skill description. In an autonomous or semi-autonomous agent workflow, this can lead to unauthorized spending, plan changes, or social-engineered purchases triggered by ambiguous user prompts.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Attaching a payment method is unrelated to the core discovery-analysis workflow and gives the skill the ability to prepare an account for future charges. Even if card data is tokenized through Stripe, exposing this capability to an agent creates a path to facilitate billing actions that users may not expect from a data-analysis skill.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Authentication and API-key lifecycle features are normal for a service API, but they are broader than strictly necessary for an agent skill whose advertised purpose is running analyses. In practice, exposing key listing and deletion operations can let an agent alter credential state or disrupt access, which is unnecessary risk if analysis can be performed with pre-provisioned scoped credentials.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The SDK documentation exposes billing, subscription, and payment-management capabilities that extend beyond the core stated purpose of data discovery. In an agent setting, this broadens the action surface from analytics into financially sensitive account operations, increasing the chance that an agent can be induced to make purchases, change plans, or alter payment state without clear user intent.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Including payment-method tokenization and billing flows inside a pattern-discovery skill is context-inappropriate because it enables collection and transmission of card data and supports charge-triggering actions from the same integration surface. In agentic environments, this creates a high-risk path for unintended financial operations or social-engineering-driven misuse, even if Stripe is used correctly.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The MCP server is described as supporting account management in addition to analysis operations, which expands the privilege boundary of a discovery tool into administrative and potentially billable actions. This is dangerous in tool-using agents because a capability advertised for data analysis can also be leveraged to alter account state, increasing blast radius if prompts are manipulated or approvals are weak.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill expands from data discovery into account lifecycle handling, including signup and login guidance. That broadens the trust boundary and encourages the agent to mediate authentication flows unrelated to the core analytical task, increasing the risk of mishandled credentials, account abuse, and unsafe privilege expansion.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Exposing billing and payment behavior in a pattern-discovery skill is unjustified by its stated purpose and creates a pathway for unauthorized or socially engineered charges. Even if intended for convenience, mixing financial operations into an analytics skill materially raises abuse potential because the agent may be prompted to spend money while the user expects only data analysis.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Including OTP-based signup and login flows allows the skill to participate in account access and session establishment, which is outside the minimum capability needed for data discovery. This can facilitate phishing-style interactions, insecure handling of one-time codes, and confusing trust signals where users are induced to share authentication material with the agent.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The MCP/SDK surface includes payment-method attachment, subscription changes, and credit purchases, none of which are required to discover patterns in tabular data. This excessive capability set makes the skill substantially more dangerous because compromise, prompt injection, or user confusion could lead to financial account changes or charges.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file-level description explicitly states the server covers discovery, estimation, and account management, and the code exposes signup, login, billing, subscription, and payment-management tools. For a skill advertised as a tabular discovery engine, these extra capabilities materially expand what an agent can do, enabling identity and financial actions that exceed the declared analytics purpose.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: These tools implement signup/login verification flows and allow adding payment methods, purchasing credits, and changing subscription plans, none of which are part of the skill's stated discovery/analytics role. In an agent context, hidden account and financial operations increase the chance of users authorizing or triggering sensitive actions they did not expect.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Billing and subscription management are context-inappropriate for a data discovery tool because they let the agent initiate financial state changes unrelated to analyzing datasets. This mismatch increases the risk of accidental purchases, subscription changes, or social-engineering abuse under the guise of running analytics.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The primary quickstart flow encourages users to upload and analyze tabular data immediately, but the nearby guidance does not clearly warn that public runs publish uploaded data and results. Because this skill targets datasets that may include sensitive business, health, or research information, users could unintentionally disclose confidential data before noticing the later visibility caveat.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The MCP configuration example shows embedding a live API key in configuration without adjacent credential-handling guidance. Users may copy this pattern into shared config files, repositories, logs, or screenshots, leading to credential exposure and unauthorized use of the account or paid API operations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The description states that public runs are free, but the skill description does not prominently warn that public analyses cause uploaded datasets and results to be published. In a data-analysis context, users may upload proprietary, personal, or regulated data, so this omission materially increases the risk of accidental data disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation states that public runs are free and published, and that uploads go to cloud storage, but it does not present this as an explicit privacy warning near the main workflow. Users or agents may therefore upload sensitive datasets without understanding that data is transmitted to external services and may become public by default, causing confidentiality and compliance risks.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill encourages users to upload datasets to a remote service but does not foreground the privacy consequences of doing so, especially for sensitive or regulated data. In a data-analysis context, users may provide proprietary, personal, or health-related datasets, so weak disclosure about remote upload materially increases confidentiality risk.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The public-analysis option mentions publication to a public gallery, but the warning is not strong enough for the sensitivity of uploaded analytical results and derived findings. Because the skill targets tabular datasets that may contain confidential business or personal information, underemphasizing public exposure can cause irreversible disclosure of sensitive data-derived insights.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The upload tool accepts an arbitrary absolute local file path and reads it if the server is running locally, without restricting allowed directories or requiring an explicit acknowledgment at the API boundary. In an agent setting, this can expose sensitive local files if a prompt or tool invocation supplies a path that the user did not fully understand or intend to share.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to upload user-provided datasets to a third-party API, but it does not clearly warn users at the point of use that their data will leave the ChatGPT environment. This creates a real privacy and consent risk, especially because datasets may contain sensitive, regulated, or proprietary information and the prompt only mentions public/private visibility and pricing, not transmission or retention implications.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests

pm_response = requests.post(
    "https://api.stripe.com/v1/payment_methods",
    auth=(stripe_pk, ""),  # publishable key as username, empty password
    data={
        "type": "card",

• Confidence: 91% confidence
• Finding: https://api.stripe.com/

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.