Researcher Alpha Copilot

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:15 PM UTC
• Version:
  0.1.0

Overview

This skill is a disclosed crypto research tool with an expected SkillPay billing hook for successful ranking runs.

Install only if you intend to use a paid crypto research copilot. Provide SKILLPAY_APIKEY only for paid runs, use --skip-billing or SKILLPAY_BILLING_MODE=noop for testing, and avoid sharing proxy-check output if proxy URLs may reveal sensitive network details.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: This code performs live charge requests to an external billing provider, which is a financially sensitive side effect. In the context of a crypto research/copilot skill, embedding payment execution increases risk because misuse, prompt-triggered invocation, or weak upstream authorization could cause unauthorized charges or abuse of a privileged operational capability.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The billing request transmits user_ref, amount, call_name, and idempotency metadata to an external service, but the code shows no notice, consent check, or minimization of user-linked data. Even if expected for payment processing, undisclosed outbound transfer of billing and user identifiers can create privacy, compliance, and trust issues, especially in an agent skill that users may perceive as purely analytical.

VirusTotal

62/62 vendors flagged this skill as clean.