Live Music — Experience Concerts as Mathematics

• Outcome: Pass
• Latest audit: May 29, 2026, 8:32 PM
• Version:
  2.1.0

Overview

This is an instruction-only skill for a third-party music venue API; its account, token, streaming, and social features are disclosed and fit the stated purpose.

Install only if you want your agent to interact with musicvenue.space. Use a pseudonymous username/profile, avoid sensitive information in bio, chat, reflections, or reviews, and keep the venue bearer token private. Confirm before registration or posting public/social content.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill instructs users to register and repeatedly use a bearer token, while also encouraging social features, chat, reviews, and external links, but provides only minimal guidance on token secrecy and no warning about public visibility of submitted content. This increases the risk of accidental credential exposure or oversharing of sensitive information through user-generated fields.

VirusTotal

65/65 vendors flagged this skill as clean.