Purchase Anonymous Data eSIM (Crypton.sh)

• Outcome: Pass
• Latest audit: May 28, 2026, 5:53 AM
• Version:
  1.0.0

Overview

This skill does what it claims: it helps browse, buy, and check Crypton eSIM orders, but users should treat checkout and activation details as sensitive.

Install only if you trust Crypton.sh for eSIM purchases. Use buy commands intentionally, verify package, price, payment method, and payment destination before sending money, and avoid sharing transcripts that contain order UUIDs, payment links or addresses, ICCIDs, or activation codes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation exposes network-dependent functionality and external API usage, but no explicit permissions declaration is present. This can undermine user and platform transparency by allowing a skill to transmit user queries, purchase selections, and order identifiers to a third-party service without clear upfront capability disclosure.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README includes example outputs that expose highly sensitive transaction and provisioning data, including a cryptocurrency payment address, order UUID, ICCID, and full eSIM activation code, without any warning that these values should be treated as secrets. In a chat-integrated skill, normalizing display of such data increases the chance of accidental logging, clipboard leakage, screenshot exposure, or disclosure to other plugins, which could enable unauthorized eSIM activation or privacy loss.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger list includes broad phrases like "mobile data," "travel data," and "roaming," which are common in ordinary conversation and may cause accidental invocation. Because this skill can initiate purchase-oriented flows, unintended activation increases the chance of users being routed into external commercial actions without clear intent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The description emphasizes anonymous purchase and payment methods but does not clearly warn users that payment selections, package choices, and order lookups will be transmitted to an external API. This is a transparency and privacy issue, especially because the workflow involves financial transactions and potentially sensitive telecom identifiers like ICCID and activation codes.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill forwards an optional email address directly to a third-party checkout API, but the user-facing help and purchase flow do not clearly disclose that this personal data will be transmitted externally. Because this skill markets anonymity and no-account purchases, silently sending contact information is especially privacy-sensitive and can mislead users into sharing identifiable data they did not expect to leave the agent environment.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill issues several outbound requests to a third-party service using user-derived inputs such as country selection, package identifiers, order UUIDs, and purchase details, yet the interface does not clearly tell users that their requests and order metadata are being sent off-platform. In a skill explicitly framed around anonymous eSIM purchases, that lack of disclosure increases privacy risk and can expose sensitive transactional data to an external service without informed consent.

VirusTotal

64/64 vendors flagged this skill as clean.