Freelance Pipeline Automation

• Outcome: Pass
• Latest audit: May 28, 2026, 6:49 AM
• Version:
  1.0.0

Overview

This is a local freelance lead tracker with overstated marketing claims, but no hidden network access, credential use, payment action, or destructive behavior was found.

Install only if you want a simple local JSON-based freelance lead tracker. Do not assume it can automatically discover jobs on Upwork, Fiverr, or LinkedIn, and keep FREELANCE_PROFILE and FREELANCE_PIPELINE pointed at a dedicated private folder.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares only Bash and Read, but its documented behavior and configuration indicate access to environment variables and file writing via exported paths and a JSON pipeline tracker. This mismatch can cause an agent or user to grant or rely on capabilities that were not transparently declared, weakening sandboxing and auditability and potentially enabling unauthorized persistence or data modification.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill description materially overstates what the implementation does, claiming multi-platform discovery, browser automation support, weighted scoring, proposal generation, and full pipeline management that are not actually implemented. In security terms, this is dangerous because operators may approve or trust the skill under false assumptions, run it in broader workflows, or grant elevated access for features that do not exist, increasing the risk of misuse and reducing effective oversight.

VirusTotal

VirusTotal findings are pending for this skill version.