XiaoPai Player Control

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:18 PM UTC
• Version:
  1.1.0

Overview

This skill openly controls a XiaoPai media player on a trusted local network, with expected cautions for discovery data and disruptive remote-control buttons.

Install only if you want an assistant to control a XiaoPai player on your trusted LAN. Verify that the discovered IP or MAC belongs to your device, avoid logging or sharing device identifiers and playback status unnecessarily, and require explicit approval before rebooting, powering off, deleting, taking screenshots, changing settings, or sending rapid key sequences.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to use shell commands and make network connections on the local network, but the metadata declares no permissions. This creates a permission-model mismatch: a host system or user may believe the skill is low-privilege while it can actually discover devices, send control commands, and query status over LAN.

VirusTotal

55/55 vendors flagged this skill as clean.