Security audit

Pin Seeker — Golf Tee Times

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward golf tee-time search helper that sends the user's search query to a documented Pin Seeker API and does not book, pay, persist, or modify anything.

Before installing, understand that golf search requests, including location, requested time, player count, and optional timezone, are sent to Pin Seeker's hosted API and results link out to GolfNow for booking. Do not use it for payment or reservation management; the skill itself is designed only to search and present links.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes shell capabilities via `curl` and a bundled `search.sh` script, but declares no corresponding permissions. This creates a capability/permission mismatch that can undermine platform security assumptions, making it easier for a seemingly low-privilege skill to perform outbound network actions or shell execution without explicit review.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.