Math Modeling Contest Route Selection

• Outcome: Pass
• Latest audit: Jun 21, 2026 at 4:46 AM UTC
• Version:
  1.0.0

Overview

This skill is a math-contest planning helper with bundled reference material and a local scoring script, and I found no evidence of hidden data access, exfiltration, or unsafe automatic actions.

Install if you want a structured contest-topic selection workflow. Review the JSON you pass into the scoring script and choose output paths deliberately; it does not need credentials or privileged access.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to read multiple reference files and run a local script, which implies file_read and file_write/code-adjacent capabilities, but no permissions are declared. This creates a trust and policy gap: the runtime may allow filesystem access that reviewers and users cannot see, increasing the risk of unauthorized local file access or modification if the skill is reused in a broader environment.

VirusTotal

63/63 vendors flagged this skill as clean.