sync with webdav

• Outcome: Pass
• Latest audit: May 29, 2026, 8:25 PM
• Version:
  1.0.4

Overview

This skill is a disclosed WebDAV backup tool that archives user-selected local paths and uploads them to a configured WebDAV destination.

Install only if you intend to upload the chosen source paths to your configured WebDAV server. Use a dedicated low-privilege WebDAV account, protect the env file, review exclude patterns before scheduling, and keep any cron or wrapper job easy to disable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill describes capabilities that read local files, create archives, invoke shell tools, and upload data over the network, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: users or orchestrators may approve or run the skill without understanding that it can access local data and exfiltrate it to a remote WebDAV endpoint using host credentials.

VirusTotal

57/57 vendors flagged this skill as clean.