Car Specs Crawler

• Outcome: Pass
• Latest audit: May 28, 2026 at 9:02 AM UTC
• Version:
  1.0.0

Overview

This is a straightforward car-spec crawler whose web requests and optional local JSON output match its stated purpose.

Install only if you are comfortable with the skill making web requests to the two named automotive sites. Use a deliberate output path with --output to avoid overwriting a file, and prefer explicit permission metadata if the platform supports it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill describes and invokes a Python crawler that performs outbound network access and can write results to local files, yet no permissions are declared. This creates a capability/permission mismatch that can bypass user or platform expectations about what the skill is allowed to do, increasing the risk of unintended data exfiltration, unauthorized web access, or filesystem modification.

VirusTotal

65/65 vendors flagged this skill as clean.