Table Mountain Status

• Outcome: Pass
• Latest audit: May 28, 2026, 1:00 PM
• Version:
  1.0.0

Overview

This appears to be a coherent status-checking skill, with some least-privilege and scoping caveats but no artifact-backed malicious behavior.

Install only if you want an agent to check Table Mountain status online and optionally save or report that status. Prefer using the default status URL, choose output paths explicitly, and confirm any scheduled or Telegram reporting before enabling it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documentation instructs use of a Python script that performs outbound network access and writes files, but the manifest shown does not declare corresponding permissions. Undeclared capabilities weaken review and policy enforcement because a user or orchestrator may invoke a skill believing it has narrower privileges than it actually uses.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The description uses broad trigger wording such as general requests for updates, alerts, and automated Telegram reports, which can cause the skill to be selected for loosely related status or notification tasks. Over-broad routing increases the chance of unintended execution of network and messaging behavior, especially in automated contexts like cron jobs.

VirusTotal

64/64 vendors flagged this skill as clean.