Finally Offline Culture MCP

• Outcome: Pass
• Latest audit: May 28, 2026, 6:37 AM
• Version:
  1.0.0

Overview

This is a disclosed remote content/newsletter skill with privacy considerations, but no evidence of hidden or malicious behavior.

Install this only if you trust the Finally Offline remote MCP service. Avoid sensitive personal details in searches, interests, agent names, and digest prompts because those requests may be processed by the external service and reading/subscription history may be retained remotely.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation criteria are broad enough to match common requests about music, design, tech, and recommendations, which can cause the skill to trigger in many ordinary conversations. Because the skill connects to a remote MCP server, over-broad invocation increases the chance of unnecessary external data transmission and tool use without clear user intent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to use a remote MCP server but does not warn that user queries and parameters may be sent to an external service. This creates a transparency and privacy risk because users may unknowingly disclose interests, search terms, or identifying subscription details to a third party.

VirusTotal

64/64 vendors flagged this skill as clean.