Security audit

Ora决策人开发专家

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed business-contact lookup tool that uses a local API key and external service for its stated purpose, with compliance cautions and no hidden destructive or unrelated behavior found.

Install only if you are comfortable using OraAgent.key with Topeasy's external API and handling returned business contact data. Use it for authorized, compliant company research, and clean up temp result files if they contain sensitive contact information you no longer need.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill explicitly instructs the agent to run Node.js scripts that read a local key file and send user-supplied queries to an external service, but no declared permissions are present. This creates a transparency and policy-enforcement gap: networked data exfiltration and local secret use can occur without an explicit permission model, which is especially sensitive here because the returned data may include contact and employee information.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.