Race Finder

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:00 PM UTC
• Version: 1.0.0

Overview

This skill is a simple race-search helper that clearly uses a public RaceFinder API and does not request sensitive access or install executable code.

Before installing, understand that race searches are sent to RaceFinder and may include locations, dates, and race preferences you provide. Do not include sensitive personal information in search terms unless you are comfortable sending it to that service.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 12)May include surrounding context.

Try it right now — no API key needed:

bash

curl "https://api.racefinder.net/api/v1/races?city=Austin&state=TX"

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

Try it right now — no API key needed:

bash

curl "https://api.racefinder.net/api/v1/races?city=Austin&state=TX"

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

Try it right now — no API key needed:

bash

curl "https://api.racefinder.net/api/v1/races?city=Austin&state=TX"

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

Try it right now — no API key needed:

bash

curl "https://api.racefinder.net/api/v1/races?city=Austin&state=TX"

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

Try it right now — no API key needed:

bash

curl "https://api.racefinder.net/api/v1/races?city=Austin&state=TX"

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

Try it right now — no API key needed:

bash

curl "https://api.racefinder.net/api/v1/races?city=Austin&state=TX"

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

Try it right now — no API key needed:

bash

curl "https://api.racefinder.net/api/v1/races?city=Austin&state=TX"

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

Try it right now — no API key needed:

bash

curl "https://api.racefinder.net/api/v1/races?city=Austin&state=TX"

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

Try it right now — no API key needed:

bash

curl "https://api.racefinder.net/api/v1/races?city=Austin&state=TX"

---

Static analysis

No suspicious patterns detected.