Wayfront

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:22 PM UTC
• Version:
  1.0.1

Overview

This is a coherent Wayfront MCP helper for querying workspace business data, with sensitive access that is disclosed and aligned with its purpose.

Install only if the agent is authorized to view the connected Wayfront workspace. Use the least-privileged MCP token available, review the live tool list before use, keep queries narrow, and avoid sharing retrieved client, billing, support, team, template, or audit-log data outside trusted channels.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly enables access to sensitive workspace business records such as clients, invoices, tickets, subscriptions, logs, and team data via an MCP token, but the documentation does not warn users about data sensitivity, least-privilege token scoping, or safe handling of retrieved information. In a business-data integration skill, this omission increases the likelihood of overbroad access, accidental disclosure, or misuse of production data.

VirusTotal

66/66 vendors flagged this skill as clean.