Arxiv Search Collector

• Outcome: Pass
• Latest audit: May 28, 2026, 11:13 AM
• Version:
  0.1.1

Overview

This skill coherently collects public arXiv metadata using disclosed local Python scripts and writes results to user-selected run directories.

Install only if you are comfortable running local Python helper scripts. Use a dedicated output/run directory, keep the default arXiv rate-limit settings, avoid untrusted python-bin or fetch-script overrides, and treat fetched arXiv text as untrusted content used only for relevance filtering.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly instructs the agent to execute Python scripts that read and write local files, call the networked arXiv API, and invoke shell commands, yet it declares no permissions or capability boundaries. That mismatch can cause downstream systems or users to invoke the skill without understanding its operational reach, increasing the risk of unintended file modification, data exposure, or network activity.

VirusTotal

63/63 vendors flagged this skill as clean.