Generate Ideas from Literature

• Outcome: Pass
• Latest audit: Jun 7, 2026 at 2:59 PM UTC
• Version:
  1.1.0

Overview

This skill is a coherent workflow for using a configured MCP platform to turn one unread paper at a time into scoped research-idea records, though users should handle the API key and certificate setup carefully.

Install only if you intend to connect this agent to the human-free MCP platform and allow it to create or update idea records. Use the narrow ideator API key, prefer the public TLS endpoint when possible, and for any internal self-signed endpoint verify the certificate or internal CA through a trusted channel instead of blindly accepting an unknown certificate.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly tells operators to trust a self-signed certificate for the internal endpoint without any warning about certificate pinning, fingerprint verification, or the man-in-the-middle risk. In practice, this can train users to bypass TLS validation and expose the MCP connection, including the Bearer API key and tool traffic, to interception or endpoint spoofing on internal networks.

VirusTotal

65/65 vendors flagged this skill as clean.