Exam Prep Pro

• Outcome: Review
• Latest audit: Jul 2, 2026 · 6:26 AM UTC
• Version: 1.4.0

Overview

This exam-prep skill provides study help, but it also asks for off-platform payment and stores activation codes locally, so users should review it before installing.

Review this carefully before installing. The study materials are coherent, but using Pro features may ask you to pay through an external QR-code flow, run a bundled Python verifier, and leave your activation code in a hidden file in your home directory. Only install if you trust the publisher and are comfortable with that payment and local-storage behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the agent to create a persistent activation marker in the user's home directory, which is a file-write capability not declared in the skill metadata. Undeclared persistence is dangerous because it expands the agent's effective privileges and can surprise users with local state changes unrelated to the core study-assistance function.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The manifest presents a study-planning skill, but the body adds payment collection, license verification, and local persistence behavior that are not disclosed in the stated purpose. This mismatch undermines user trust and can be used to smuggle non-essential capabilities into a benign-seeming skill, increasing the chance of deceptive or unauthorized actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to solicit payment and display a QR code as part of a gated activation flow, which is unrelated to normal exam-preparation assistance. Embedding payment instructions inside a skill creates phishing-like risk, can pressure users into off-platform transactions, and is especially suspicious because the payment behavior is not core to the educational function.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill requires running a local verification script to validate activation codes, even though license checking is not necessary for generating study plans or practice questions. Unnecessary script execution increases attack surface, may enable arbitrary local command execution patterns, and normalizes running local code based on user-provided input.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The instruction to write an activation record into ~/.exam-prep-pro.activated creates persistent local state in the user's home directory for a feature unrelated to study assistance. Persistent writes can expose privacy concerns, bypass user expectations, and create a foothold for tracking or later behavior changes without clear consent.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest describes an exam-preparation tool, but the documented behavior adds paid licensing and activation controls that are absent from the description. Hidden monetization and gating features are risky because they conceal material functionality from users and reviewers, making deceptive use of the skill more plausible.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger terms are extremely broad and can match ordinary study-related conversation, causing the skill to activate in contexts where users did not intend to engage with it. Because the skill contains payment and activation flows, over-broad routing makes accidental exposure to monetization prompts more likely.

Vague Triggers

Low

• Confidence: 78% confidence
• Finding: The instruction to proactively react when users say things like 'I already purchased' or 'I have an activation code' encourages the agent to enter licensing flow from ambiguous statements. In a skill already containing off-purpose payment and activation behavior, this increases the chance of steering users into unnecessary monetization or verification steps.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to store an activation record locally without any user-facing warning or consent for the file write. Silent persistence is risky because it modifies the user's environment, may expose local state or privacy concerns, and is unnecessary for the stated exam-preparation context.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script writes the full activation code to a hidden file in the user's home directory without warning, which creates unnecessary local secret persistence. If the code is reused across devices or tied to account entitlements, other local users, malware, backups, or support artifacts could recover it and misuse the license.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The legacy activation branch repeats the same insecure behavior by persisting the raw activation code to disk without notice. This duplicates the exposure path and increases the chance that valid codes are leaked through local file access, backups, or diagnostics.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.