Ebusy Courts

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:15 PM UTC
• Version:
  1.0.0

Overview

This skill appears to do what it says: it logs into a configured eBusy tennis booking site and shows reservation information.

Install only if you are comfortable giving an agent eBusy login credentials for the selected hall. Verify EBUSY_BASE_URL points to the correct club site before running it, keep credentials out of the skill folder, and treat returned reservation names or notes as potentially private.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documentation declares no permissions, yet it explicitly instructs use of environment variables for credentials and network access to remote eBusy instances. This creates a transparency and policy-enforcement gap: agents or reviewers may underestimate that the skill handles secrets and performs outbound authentication requests, increasing risk of unintended secret exposure or overly broad execution in a runtime that relies on declared permissions.

VirusTotal

64/64 vendors flagged this skill as clean.