Gravitational Wave Event Analyzer

• Outcome: Pass
• Latest audit: May 29, 2026, 8:32 PM
• Version:
  1.0.0

Overview

This skill appears to do what it says: fetch public gravitational-wave data, analyze it locally, and save user-directed reports and plots.

Install this only if you are comfortable with it downloading public data from GWOSC and writing analysis outputs locally. Run it in a fresh Python environment, use a dedicated output directory, and prefer current patched dependency versions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly performs network access to GWOSC and writes output files, but it does not declare corresponding permissions or constraints. This creates a transparency and policy gap: users or platforms may invoke it without realizing it will contact external services and persist data locally, which can lead to unexpected data egress, unreviewed outbound requests, or filesystem side effects.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill description states it fetches real data from GWOSC, but it does not prominently warn users that execution requires external network access. While the source appears legitimate and domain-appropriate, missing disclosure reduces informed consent and can surprise users in restricted or privacy-sensitive environments.

VirusTotal

66/66 vendors flagged this skill as clean.