Agent Rate Limiter

• Outcome: Pass
• Latest audit: May 28, 2026 at 4:49 AM UTC
• Version:
  1.3.1

Overview

This skill is a local rate-limit helper that behaves consistently with its stated purpose and does not show hidden data collection or unsafe actions.

Install this if you want your agent to throttle itself based on local estimates. Review any prompt, heartbeat, or cron integration before enabling it, keep RATE_LIMIT_STATE pointed at a non-sensitive JSON path, and remember that reset clears prior limiter history.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This markdown file documents that the skill writes a JSON state file and that `reset` clears all history, but it does not present this as a safety warning about modifying local files or deleting persisted tracking data. For a skill description, user-facing disclosure about local state persistence and reset side effects would make the data-impact behavior clearer.

VirusTotal

66/66 vendors flagged this skill as clean.