Ai Insurance Advisor

• Outcome: Pass
• Latest audit: Jun 2, 2026, 5:52 PM
• Version:
  1.8.191

Overview

The skill appears to use packaged reference materials for its stated guidance purpose, with no evidence of hidden execution, credential handling, persistence, or destructive behavior.

Before installing, confirm the skill only needs its packaged reference files and does not request broader filesystem access in your runtime. The current evidence supports normal, purpose-aligned use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to read local reference files such as `references/products.json`, `references/insurance-knowledge.md`, and `references/compliance.md`, but no corresponding permission declaration is present. This creates a capability/permission mismatch: in permissive runtimes the skill may access local files without explicit review, while in stricter runtimes it may fail unpredictably, undermining security review and least-privilege controls.

VirusTotal

61/61 vendors flagged this skill as clean.