Steam Games Updates

• Outcome: Pass
• Latest audit: May 29, 2026, 8:18 PM
• Version:
  1.0.0

Overview

This skill coherently fetches public Steam game news and stores a small local tracking history for that purpose.

Before installing, know that running the skill contacts Steam and keeps local JSON files for tracked games, last-run state, and accumulated public update records. Remove those files if you do not want local history retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill performs network access to Steam APIs and writes persistent data files, but it does not declare any permissions for those capabilities. This creates a transparency and policy-enforcement gap: a host may allow the skill to run without surfacing or gating the actual side effects, and users may not realize the skill stores data locally and makes outbound requests.

VirusTotal

53/53 vendors flagged this skill as clean.