Gevety MCP

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Gevety health-data assistant that uses a user-provided token to read sensitive health data from Gevety's API, with no artifact evidence of unrelated access or exfiltration.

Install only if you intend your agent to access your Gevety account data, including labs, medications, medical profile, wearable data, and health documents. Use a dedicated Gevety API token, keep it out of chat when possible, revoke it if no longer needed, and avoid asking the agent to retrieve more medical data than necessary.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This skill is designed to access and transmit highly sensitive health information to an external API, yet it does not prominently warn users up front that protected health-related data and an API token will be sent to a third-party service. In a health context, lack of explicit disclosure and consent is risky because users may unknowingly expose lab results, medications, conditions, and documents to an external processor.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal