Wishfinity +W

• Outcome: Pass
• Latest audit: May 27, 2026 at 10:46 PM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed Wishfinity shopping wishlist integration, with the main considerations being trust in its external npm MCP server and sharing product links with Wishfinity.

Install this only if you trust Wishfinity and the `wishfinity-mcp-plusw` npm package. Avoid saving product URLs that contain private tokens, personal identifiers, or session-specific information, and consider pinning the MCP package version if your environment supports it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrase "I want this" is broad and commonly appears in ordinary shopping or product discussion, so the skill may invoke a save-to-wishlist flow when the user did not explicitly ask for that action. In a commerce assistant, this can cause unintended external-link generation, user confusion, and accidental wishlist additions, especially when many products are being discussed.

VirusTotal

58/58 vendors flagged this skill as clean.