Security audit
Surprise Buddy
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed gift-search connector to an external Surprise Buddy MCP service and does not request local access, credentials, persistence, or elevated privileges.
Reasonable to install for ordinary gift browsing. Avoid entering highly sensitive personal details about gift recipients, and review returned marketplace links before clicking if tracking or affiliate-style query parameters matter to you.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.