Webhook Promo Scheduler

• Outcome: Pass
• Latest audit: May 28, 2026 at 12:52 PM UTC
• Version:
  0.1.1

Overview

This skill does what it claims: it posts user-provided promotional messages to a user-provided webhook and keeps a local posting ledger.

Install only if you are comfortable with a tool that sends selected local message content to a webhook URL. Keep the Discord webhook private, prefer secret injection over exposing it in shell history or process lists, use --dry-run first, and point --messages-file only at files intended to be posted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill performs network access and file reads but does not declare corresponding permissions, creating a capability/permission mismatch. This is dangerous because users or hosting platforms may underestimate what the skill can do, especially since it handles a sensitive Discord webhook secret and a local ledger file.

VirusTotal

64/64 vendors flagged this skill as clean.