connect-to-skilder

• Outcome: Review
• Latest audit: Jul 28, 2026 · 2:19 PM UTC
• Version: 1.0.2

Overview

This skill is a straightforward Skilder MCP connector, but it tells the agent to make persistent MCP configuration changes and start OAuth without asking the user first.

Install only if you intentionally want this agent connected to Skilder. Before use, confirm the exact MCP host/config that will be modified, review Skilder's OAuth permissions and exposed tools, and prefer a temporary or reversible setup where possible.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The description explicitly says the skill should be pasted into chat and act immediately without asking the user anything first. That broad invocation model enables unintended activation from generic context and can cause an agent to modify configuration and initiate external connections without informed user approval.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The body repeats auto-execution language such as proceeding automatically and not asking clarifying questions. In context, this is dangerous because the skill is not a passive reference; it directs the agent to take external actions immediately, bypassing normal safety checks around tool use and environment changes.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This section instructs the agent to register a remote MCP server, alter local MCP configuration, and immediately call the server to trigger OAuth, all without a user-facing warning. Those are sensitive actions because they establish trust in an external service, may persist across sessions, and can expose the user to unreviewed capabilities or data flows.

Ssd 1

Medium

• Confidence: 94% confidence
• Finding: The one-shot framing is designed to make the agent treat the content as an authoritative command that should be executed immediately. This weakens normal boundaries around user confirmation and increases the chance that a pasted prompt can coerce tool use or system changes without meaningful review.

Ssd 1

Medium

• Confidence: 95% confidence
• Finding: The repeated directives to proceed automatically and avoid questions pressure the agent away from safe interaction patterns. In a skill whose purpose is to connect to an external endpoint, that pressure materially increases the risk of unauthorized connection attempts and configuration changes.

Ssd 1

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent not to ask permission before attempting the connection and OAuth flow. That is dangerous because it directs unilateral external access and may trigger browser-based authentication or trust establishment without the user's informed consent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

---
name: connect-to-skilder
description: One-shot instruction to connect this AI agent to Skilder over MCP using the official remote endpoint and OAuth. Paste this whole skill into an agent's chat once. It should act on it immediately, without asking the user anything first.
version: 1.0.2
homepage: https://github.com/skilder-ai/skills
---

• Confidence: 93% confidence
• Finding: without asking

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

homepage: https://github.com/skilder-ai/skills
---

You've just been handed this as a one-time instruction. Proceed automatically. Don't
ask the user any clarifying questions first. The endpoint is fixed and already known:

    https://app.skilder.ai/mcp

• Confidence: 93% confidence
• Finding: Don't ask the user

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.