Design Studio V101

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  1.0.1

Overview

This skill is a local design-asset generator, and its file creation and image-editing behavior matches what it advertises.

Install this if you want an agent to generate and edit local design files. Use explicit output directories, keep backups of important source images, and provide an output path when watermarking so originals are not overwritten.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises direct use of shell commands and file read/write capable tools, but the manifest shown does not declare any permissions or constraints. That creates a trust and containment gap: an agent may invoke local tooling to read or modify files or execute commands without an explicit permission model, increasing the chance of unintended filesystem access or command execution. In this skill's context, those capabilities are operationally relevant for image generation, batch processing, and CLI design tools, which makes the omission more dangerous rather than less because the powerful behaviors are normalized by the workflow.

VirusTotal

65/65 vendors flagged this skill as clean.