qsnctf-practice-dynamic

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:26 PM UTC
• Version:
  1.0.0

Overview

This skill is a small, read-only QSNCTF lookup helper that fetches public leaderboard and activity data from disclosed endpoints.

Before installing, note that the skill contacts www.qsnctf.com and may require installing Python requests. Use a trusted Python environment for the dependency, and install only if you are comfortable sending lookup requests to that public QSNCTF service.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill explicitly documents outbound HTTP requests to qsnctf.com APIs, yet no permissions are declared. This creates a transparency and policy-enforcement gap: users and the hosting platform may not realize the skill performs network access, which can weaken consent, auditing, and sandbox controls even if the target API itself appears benign.

VirusTotal

64/64 vendors flagged this skill as clean.