TSE Eleições

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:43 PM UTC
• Version:
  1.0.0

Overview

This is a straightforward Python client for public Brazilian election data APIs, with no evidence of hidden credential use, persistence, or destructive behavior.

Install only if you are comfortable with the skill making outbound requests to the documented TSE and CKAN public endpoints. No credentials should be needed. Use a virtual environment and review the live GitHub repository if you choose to clone it instead of relying only on the packaged files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation describes and demonstrates network access to external TSE and CKAN endpoints, but the skill declares no corresponding permissions. This creates a transparency and policy-enforcement gap: users or hosting platforms may treat the skill as less privileged than it really is, leading to unintended outbound requests and weakened review controls.

VirusTotal

66/66 vendors flagged this skill as clean.