nvd-cve
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local Python scripts using environment-defined wrappers ($MCP_CALL and $NVD_MCP_SCRIPT). This is a standard and expected mechanism for tool execution within this agent platform context.
- [CREDENTIALS_UNSAFE]: The skill follows security best practices by using environment variables ($NVD_API_KEY) to handle sensitive credentials rather than hardcoding them.
- [DATA_EXFILTRATION]: The skill performs network requests to the NIST National Vulnerability Database. This is a well-known, trusted service and the activity is strictly aligned with the skill's stated purpose for security auditing.
- [PROMPT_INJECTION]: The skill processes potentially untrusted data from device outputs (software versions) and external API results (vulnerability descriptions), creating an inherent surface for indirect prompt injection.
- Ingestion points: Software version strings from devices and CVE descriptions from the NVD API.
- Boundary markers: None provided in the command examples.
- Capability inventory: Execution of local scripts and network access to the NVD API.
- Sanitization: Not explicitly detailed in the instructional content, but typical for these API-based tool implementations.
Audit Metadata