Security audit

predictalot

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed client for a self-hosted forecasting service, with real but clearly described network and model-management risks.

Install this only if you are comfortable sending forecast inputs and engineered features to the configured predictalot server. Prefer a loopback or trusted HTTPS endpoint with a strong bearer token, avoid using proprietary data with an untrusted PREDICTALOT_URL, and confirm model deletions carefully because they cannot be undone.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

External Transmission

Medium

Category: Data Exfiltration
Content: -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" | jq # Zero-shot univariate forecast: 5 steps ahead of one series, chronos-2. curl -s $PREDICTALOT_URL/v1/timeseries/univariate/forecast \ -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \ -H "Content-Type: application/json" \ -d '{
Confidence: 60% confidence
Finding: curl -s $PREDICTALOT_URL/v1/timeseries/univariate/forecast \ -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

Category: Data Exfiltration
Content: -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" | jq -r '.models[].slug' # 2. Forecast with chronos-2 (default all-rounder), 12 steps, three bands. curl -s $PREDICTALOT_URL/v1/timeseries/univariate/forecast \ -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \ -H "Content-Type: application/json" \ -d '{"model":"chronos-2","context":[[100,102,101,105,110,108,112,115,120,118,125,130]],
Confidence: 60% confidence
Finding: curl -s $PREDICTALOT_URL/v1/timeseries/univariate/forecast \ -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

Category: Data Exfiltration
Content: "config":{"mode":"direction","horizon":3,"nEstimators":400}}' | jq # 2. Forecast — LAST feature row is the anchor. curl -s $PREDICTALOT_URL/v1/tabular/forecast \ -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \ -H "Content-Type: application/json" \ -d '{"modelId":"trend-3","features":[{"rsi":[72],"mom":[0.8]}]}' | jq
Confidence: 60% confidence
Finding: curl -s $PREDICTALOT_URL/v1/tabular/forecast \ -H "Authorization: Bearer $PREDICTALOT_AUTH_TOKEN" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

Category: Data Exfiltration
Content: auth=(-H "Authorization: Bearer ${PREDICTALOT_AUTH_TOKEN}") fi resp="$(curl -sS -w $'\n%{http_code}' \ "${PREDICTALOT_URL}/v1/timeseries/univariate/forecast" \ "${auth[@]}" \ -H "Content-Type: application/json" \
Confidence: 70% confidence
Finding: curl -sS -w $'\n%{http_code}' \ "${PREDICTALOT_URL}/v1/timeseries/univariate/forecast" \ "${auth[@]}" \ -H "Content-Type: application/json" \ -d

Tool Parameter Abuse

High

Category: Tool Misuse
Content: - **Network-exposed** — predictalot is a plain HTTP + MCP service; anyone who can reach the port can call it. Set `PREDICTALOT_AUTH_TOKENS` to a strong generated secret (`$(openssl rand -hex 32)`) and bind to loopback (`-p 127.0.0.1:8080:8080`) by default. Only expose beyond loopback behind a reverse proxy / VPN, and never with the default/example token. - **External transmission** — every forecast/train call sends your time series, engineered feature values, and/or `modelId`s to whatever `PREDICTALOT_URL` points at — that data leaves your host. Point it only at a service you run or explicitly trust; prefer HTTPS. - **Consumer-only** — this skill talks to an instance you already run and trusts. It never provisions, starts, or hardens the server; that's the operator's job (see setup.md). - **Destructive delete requires confirmation** — `DELETE /v1/tabular/models/{modelId}` permanently removes a trained model and cannot be undone. Only call it against a `modelId` you obtained from a prior `GET /v1/tabular/models` (or a train response) in this session, and get explicit user confirmation before issuing the delete. ## When To Use
Confidence: 80% confidence
Finding: DELETE /v1/tabular/models/{modelId}`

Tool Parameter Abuse

High

Category: Tool Misuse
Content: **Response** (`EnsembleForecastResponse`): `mode`, `horizon`, `ensembleMembers`, normalized `weights`, `individual` (`{modelId: member response}`), plus the combined mode-specific fields (`probUp`+`confidence` / `predicted` / `median`+`quantiles`). ### `GET /v1/tabular/models` and `DELETE /v1/tabular/models/{modelId}` (destructive) `GET` lists stored models: `{"models": [{ modelId, backend, mode, horizon, nFeatures, featureNames, nTrainingRows, trainedAtUnix }]}`. `DELETE` removes one (`{"modelId": "...", "removed": true}`; 404 if absent) — **irreversible**. Only delete a `modelId` returned by a prior `GET /v1/tabular/models` call (or a train response), and get explicit user confirmation first.
Confidence: 80% confidence
Finding: DELETE /v1/tabular/models/{modelId}`

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.