HK Parking Meter Finder

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:27 PM UTC
• Version:
  1.0.1

Overview

This skill appears to fetch public Hong Kong parking-meter data as advertised and does not show credential access, persistence, or destructive behavior.

Install this only if you are comfortable with the agent running the bundled Python script and contacting official Hong Kong public-data endpoints for live parking results. The reviewed artifacts do not show credential use, persistence, or unrelated data collection.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill documentation instructs the agent to run a bundled Python script that fetches official parking inventory and live occupancy data, which implies network access, yet no permissions are declared. Undeclared network capability weakens transparency and policy enforcement because reviewers and runtime controls may not realize the skill can contact external resources, even if the stated purpose is legitimate.

VirusTotal

64/64 vendors flagged this skill as clean.