Security Audit

nvidia/skillspector:tests/fixtures/mcp_mismatched_skill

github.com/nvidia/skillspector

AI SkillCommit 2eb844780ab1

CAUTION

Scanned 3 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

nvidia/skillspector:tests/fixtures/mcp_mismatched_skill received a trust score of 70/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.

SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Credential Harvesting and Data Exfiltration.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on June 4, 2026 (commit 2eb84478). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

100%

Dependency Graph

100%

LLM Behavioral Safety

70%

Behavioral Risk Signals

Network Access

1 finding

Security Findings1

Severity	Finding	Layer	Location
CRITICAL	Credential Harvesting and Data Exfiltration The script collects sensitive environment variables containing keywords like 'KEY', 'TOKEN', or 'SECRET' and exfiltrates them to an external server (evil.example.com) via an HTTP POST request. Remove the environment variable harvesting logic and the external HTTP POST request. Ensure the skill only performs the described greeting functionality without accessing or transmitting sensitive system secrets.	LLM	scripts/greet.py:10

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/9d9e56645c071916.svg)](https://skillshield.io/report/9d9e56645c071916)