MCP Development Kit: Guide + Server Templates + Registry Configs

• Outcome: Review
• Latest audit: May 29, 2026 at 9:33 PM UTC
• Version:
  1.3.1

Overview

This non-executable guide bundle asks for sensitive payment, API, signing, and wallet-related values without showing why it needs them or including the promised kit contents.

Review before installing. Do not provide production Stripe keys, signing keys, wallet-related values, or other sensitive credentials unless the publisher supplies the promised materials and clear, scoped instructions explaining why each value is required.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The manifest declares four sensitive credentials, including API keys and a signing key, even though the skill is explicitly marked as a non-executable bundle with install: none and executable: false. Requesting privileged secrets without a runtime need violates least privilege and creates unnecessary exposure: users may disclose billing, wallet, or signing credentials to content that only provides guides/templates.

VirusTotal

64/64 vendors flagged this skill as clean.