Ecommerce Price Watcher

• Outcome: Pass
• Latest audit: May 28, 2026 at 1:18 PM UTC
• Version:
  1.1.0

Overview

This skill is a normal price watcher with expected web lookups and local watch history, with minor disclosure gaps rather than Review-level risk.

Install only if you are comfortable with the skill fetching ecommerce pages and, in item-query mode, sending your product search terms to DuckDuckGo. Use direct product URLs or --trusted-only for tighter control, and remember that watched URLs, queries, and price history remain in the local state file until removed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises and instructs use of a Python script that performs network requests and persists watcher state, but the skill file declares no permissions. This creates a capability/permission mismatch that can bypass least-privilege review and lead operators to approve a skill without understanding it can read/write local data and access external URLs.

VirusTotal

64/64 vendors flagged this skill as clean.