Dnd Character Skill

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:39 PM UTC
• Version:
  1.0.0

Overview

This skill is a small user-run D&D image generator that sends the provided prompt and API token to a disclosed external image service.

Install only if you intend to share prompts, reference IDs, and a Neta/TalesOfAI API token with that image service. Use a token scoped to this provider, avoid putting secrets or sensitive campaign material in prompts, and prefer passing the token through a shell variable instead of typing it directly in reusable command history.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill invokes an external image-generation API and requires a user-supplied token, which implies outbound network access, but the manifest does not declare corresponding permissions. This creates a trust and review gap: users may install a skill believing it has limited capabilities while it can transmit prompts and secrets to a remote service.

VirusTotal

66/66 vendors flagged this skill as clean.