IMDb Contribution Questions API

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:43 PM UTC
• Version:
  1.0.0

Overview

No malicious behavior is indicated, but the skill appears to send an API token in the request URL, which users should treat as a credential-exposure risk.

Install only if you trust the API provider and can use a limited, revokable token. Avoid sharing logs, traces, or full request URLs from this skill, and rotate the token if a URL containing it is exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The API authentication token is defined and sent as a query parameter, which places the secret in the URL. URLs are commonly logged by proxies, servers, browser history, monitoring systems, and exception traces, so this increases the chance of credential exposure even when HTTPS is used. In this skill context, the code also injects the token automatically and provides no warning, so accidental leakage is more likely.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The API requires the authentication token to be sent as a query parameter, which is commonly exposed in logs, browser history, intermediary proxies, monitoring tools, and referrer headers. Even if HTTPS is used, placing secrets in the URL materially increases the chance of credential leakage and unauthorized reuse of the token.

VirusTotal

65/65 vendors flagged this skill as clean.