Contact Centre Grok Pack

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:44 PM UTC
• Version:
  1.0.0

Overview

This skill locally turns user-provided call transcripts into routing JSON, with no evidence of network access, credential use, hidden automation, or external system changes.

Use this only with transcripts you are allowed to process. Avoid saving JSON output unless needed, store any saved results as sensitive customer, health, housing, or support data, and keep the documented human review step before routing results into live CRM, helpdesk, clinic, or council systems.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation describes reading input transcripts and optionally writing JSON output, but it declares no permissions despite those code capabilities being present. This creates a permission-transparency gap: operators may approve or run the skill without understanding it can access local files, which increases risk if the implementation is later modified, misused, or pointed at sensitive paths.

VirusTotal

66/66 vendors flagged this skill as clean.