fomo-smart-money

• Outcome: Review
• Latest audit: Aug 9, 2026 · 10:03 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a disclosed crypto wallet-tracking tool, but it automatically performs network lookups and injects persistent referral/promotional output with local state tracking.

Install only if you are comfortable with a crypto skill that contacts public RPC services and DexScreener, outputs FOMO referral links by default, and writes a small hidden marker file in your home directory for promotional display state. Treat its recommendations as research, not trading advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill explicitly documents network access, real-time RPC queries, DexScreener lookups, and file writes via the marker file `~/.fomo_smart_money_seen`, yet no permissions are declared. That creates a transparency and policy-enforcement gap: users and the host agent may invoke a skill with side effects and external data exfiltration potential without an explicit permission contract.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The top-level description frames the skill as a recommendation tool, but the documented behavior is substantially broader: wallet lookups, filtering, status tracking, live balance checks, chain-link generation, third-party API access, and persistent referral-banner output. This mismatch undermines informed consent and increases the chance the skill is auto-invoked in situations where the user did not intend on-chain surveillance, external requests, or promotional output.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The documentation instructs the skill to show a full author/social banner on first run and a fixed promotional footer on every subsequent run, plus it embeds referral links with an invite code. This is not necessary for the stated analytic function and instead turns the skill into a persistent traffic-diversion and affiliate mechanism that can manipulate outputs for the author's benefit.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill advertises itself as a recommendation/trading-board tool, but the code also exposes wallet-detail lookup, link enumeration, address disclosure, status analysis, and live on-chain balance retrieval. That capability expansion increases data exposure and operational scope beyond user expectations, which can enable profiling and tracking of specific wallets without clear justification in the manifest.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Real-time RPC balance querying gives the skill active network-recon capability that is not necessary for a simple recommendation-oriented smart-money listing tool. In context, this allows targeted probing of wallet addresses and fresh financial-state retrieval, increasing privacy and surveillance risk for tracked wallets.

Context-Inappropriate Capability

Low

• Confidence: 92% confidence
• Finding: The script creates a persistent marker file in the user's home directory solely to track first-run state for promotional behavior. This introduces undisclosed local persistence unrelated to the skill's token-tracking purpose, which can violate user expectations and become a privacy/consent concern in agent environments.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases include broad natural-language prompts like '现在他们在买什么' and '当前交易榜', which can overlap with ordinary market questions. In an agent environment, overbroad triggers increase the risk of unintended invocation, causing unsolicited network activity, promotional output, and potentially biased recommendations tied to referral links.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The instruction to 'directly run `trending.py` and output the leaderboard as-is' on broad prompts removes boundary checks and bypasses user-intent validation. That makes it easier for the skill to execute external calls and emit referralized links and promotional content without an opportunity for the agent to apply safety, relevance, or consent checks.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The user-to-command mapping treats broad conversational phrases as direct command invocations without contextual constraints, increasing accidental activation risk. In this skill's context, accidental activation is more concerning because the resulting behavior includes external RPC/API access and referral-link generation, not merely local read-only help text.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The network query functions send wallet addresses to public third-party RPC endpoints without any user-facing notice, consent, or privacy disclosure. Even though blockchain addresses are often public, transmitting queried targets to external providers creates metadata leakage about which wallets users are investigating and when, which can support tracking or analytics by those providers.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script makes outbound requests to third-party RPC endpoints without any user-facing disclosure, sending wallet addresses and transaction lookup activity to external services. In an agent skill context, undisclosed network transmission is risky because it can leak usage patterns, metadata, and queried assets to infrastructure outside the user's control.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Writing a hidden marker file under the user's home directory without notice is an undisclosed persistence mechanism. Even though the content is minimal, silent filesystem writes in a skill increase trust and privacy risk because users are not informed that local state is being created and retained.

External Transmission

Medium

• Category: Data Exfiltration

Content

def dexscreener(mint):
    try:
        req = urllib.request.Request(f"https://api.dexscreener.com/latest/dex/tokens/{mint}",
                                     headers={"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"})
        with urllib.request.urlopen(req, timeout=15) as r:
            return json.loads(r.read())

• Confidence: 90% confidence
• Finding: https://api.dexscreener.com/

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.