Security audit
Worldcup Predictor
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed World Cup prediction tool that uses a local schedule cache and an optional sports API key without evidence of hidden or unsafe behavior.
This appears safe to install for match prediction. Before use, decide whether you want to configure the optional BALLDONTLIE API key; if you do, store only that skill-specific key and expect requests to be sent to the documented sports API. The schedule cache may become stale, but that is a data-quality concern rather than a security issue.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.