python-arch-optimizer

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:21 PM UTC
• Version:
  1.0.2

Overview

This skill is a disclosed Convex migration guide that may help change project code and database data, but its behavior matches its stated purpose.

Install only if you want the agent to help edit Convex schema/migration files and potentially run Convex commands. Review generated migration code, use dryRun first, verify affected records, and be especially careful before running commands against production.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill describes file-modifying behavior via the migration script, but no explicit permissions declaration is present. This creates a capability/permission mismatch that can lead an agent platform or user to underestimate the skill's ability to write and move files, increasing the risk of unintended destructive changes if the skill is invoked.

VirusTotal

65/65 vendors flagged this skill as clean.