Full-Stack Web Engineer

• Outcome: Review
• Latest audit: May 28, 2026, 6:09 AM
• Version:
  1.0.2

Overview

This skill is mostly educational web-engineering guidance, but one API example could lead users to create an unauthenticated admin account path if copied into a real app.

Review before installing or using this skill for code generation. If used, do not copy the user-creation example as-is: self-service registration should assign a safe default role server-side, and privileged role assignment should require authenticated admin authorization.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The skill presents a user-creation route with no authentication while allowing the client to supply the role field and select admin. In a real implementation, this enables unauthenticated privilege escalation by self-registering an administrator account, directly undermining the authorization model described elsewhere in the document.

VirusTotal

64/64 vendors flagged this skill as clean.