Security audit
Security checks for vulnerabilities and agentic risk
The skill looks like a crypto wallet tracking demo but presents itself as a live alerting product, which could mislead users about financial signals.
Review this carefully before installing. It does not appear to contain malware or persistence, but it should not be relied on for trading or wallet intelligence unless the publisher clearly labels it as a demo or adds real, verifiable data sources and alert logic. Do not provide Telegram or Etherscan credentials to this version unless the implementation is updated to actually use them for the advertised purpose.
The skill markets itself as a live crypto wallet tracker with buy/sell alerts, but the file content does not define any real monitoring, alerting, or blockchain-querying behavior. In a financial context, this can mislead users into relying on nonexistent signals or simulated data, creating operational and financial risk even if there is no direct code execution issue in this file.
This manifest description explains what the skill does but does not specify when it should be invoked, what exact phrases should trigger it, or any exclusion conditions. For a manifest file, the absence of trigger specificity can lead to unintended activation from broad wallet- or crypto-related requests.
The skill metadata includes user-facing pricing and feature descriptions in Chinese while the rest of the skill is primarily in English, with no indication that users can choose their preferred language. This can impose a locale/language experience without user opt-in and conflicts with the requirement to avoid forced language selection.
The skill description promises real KOL wallet tracking and buy/sell alerts, but the implementation only prints hard-coded sample wallets, trades, and portfolio data. In a crypto context, this is dangerous because users may rely on fabricated or stale information for trading decisions, creating financial risk and undermining trust in the agent's outputs.
This Python file contains multiple user-facing strings in Chinese such as wallet labels, trade timing, and portfolio headings, while the module docstring and some other text are in English. The skill does not offer a language selection mechanism or state that it is intentionally Chinese-only, which can violate a language/locale policy requiring user opt-in.
No suspicious patterns detected.
