Payment Link Reader

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:23 PM UTC
• Version:
  1.0.0

Overview

This skill is a straightforward payment-link lookup utility that sends a user-provided GStable link ID to a documented API and prints product details.

Install only if you are comfortable running npm dependencies and sending payment link IDs you inspect to GStable, or to whatever endpoint you deliberately set in GSTABLE_API_BASE_URL. Leave the base URL unset unless you trust the alternate service.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation and metadata indicate it requires network access and can read environment configuration via `GSTABLE_API_BASE_URL`, but it does not explicitly declare permissions for those capabilities. This creates a transparency and trust problem: users or hosts may execute a skill with broader capabilities than advertised, increasing the risk of unintended outbound requests or abuse of environment-controlled configuration.

VirusTotal

62/62 vendors flagged this skill as clean.