SaffronAI ETF Data

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:27 PM UTC
• Version:
  1.0.0

Overview

This looks like a documented Python/API helper with a permission-metadata gap, but no evidence of hidden or harmful behavior.

Install only if you are comfortable with the skill running the documented python3 commands and contacting its public API endpoint. Review any required tokens or environment variables, and prefer scoped credentials if the skill asks for them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill invokes shell commands via documented `python3` executions but does not declare any permissions, creating a mismatch between advertised and actual capabilities. This can bypass least-privilege controls and make reviewers or execution frameworks underestimate what the skill can do, especially since it also performs outbound network access to a public endpoint.

VirusTotal

65/65 vendors flagged this skill as clean.