api3-data-feed-purchase

• Outcome: Review
• Latest audit: Aug 3, 2026 · 1:55 PM UTC
• Version: 0.7.0

Overview

The skill mostly matches its stated purpose, but it asks users to keep a wallet seed phrase in a local .env file and can sign a real blockchain purchase transaction.

Review this carefully before installing. Use only a dedicated wallet with limited funds, avoid placing a main wallet seed phrase in .env, verify the quoted amount and chain before approving the purchase, and prefer a safer signing method or a freshly created low-value wallet.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes networked scripts and depends on an environment secret (`WALLET_MNEMONIC`), but it does not declare corresponding permissions or capabilities in a clear, enforceable way. This creates a transparency and policy-enforcement gap: a reviewer or runtime may underestimate what the skill can access and do, including signing a blockchain transaction.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The skill first instructs the agent to never read `.env` files or ask for secrets, but later depends on a mnemonic being placed in `.env` and prompts the user about that setup. This contradiction weakens safe secret-handling boundaries and normalizes workflows where a highly sensitive wallet seed is stored locally in a predictable plaintext location.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The metadata declares `WALLET_MNEMONIC` as an environment requirement, but Phase 5 tells the agent to ensure it is set in a root `.env` file. That mismatch encourages insecure fallback behavior and can lead operators to store a seed phrase in plaintext on disk rather than using safer runtime provisioning.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script's behavior does not match the declared skill purpose: instead of purchasing Api3 data feed subscriptions, it enumerates providers and fetches public signed feed values. This kind of capability mismatch is dangerous because downstream agents or users may invoke the skill expecting a transactional purchase flow, but instead disclose feed metadata, make unintended external network requests, or fail to perform the promised action, which can undermine security assumptions and enable misuse in larger workflows.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: Directing the user to place a wallet mnemonic in a local `.env` file and then run a purchase script creates a human-language path for handling one of the most sensitive cryptocurrency secrets. If that file is exposed, logged, committed, or read by other tools, an attacker could fully compromise the wallet and steal funds, making the context especially dangerous because the skill is explicitly built to sign live blockchain transactions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"type": "module",
  "dependencies": {
    "@api3/dapi-management": "4.32.0",
    "@openzeppelin/merkle-tree": "^1.0.8",
    "dotenv": "^17.4.2",
    "ethers": "^6.16.0"
  }

• Confidence: 94% confidence
• Finding: The dependency uses a caret range, which permits automatic installation of newer compatible versions rather than an exact audited release. In a security-sensitive skill that purchases blockchain data feed subscriptions, this increases supply-chain risk because a compromised or breaking upstream release could be pulled in without explicit review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "@api3/dapi-management": "4.32.0",
    "@openzeppelin/merkle-tree": "^1.0.8",
    "dotenv": "^17.4.2",
    "ethers": "^6.16.0"
  }
}

• Confidence: 94% confidence
• Finding: The dotenv package is specified with a caret range, allowing npm to resolve newer versions automatically within the major version. While common in development, this is still a supply-chain exposure because the installed code may change over time, which is undesirable for a skill handling API and blockchain-related operations.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@api3/dapi-management": "4.32.0",
    "@openzeppelin/merkle-tree": "^1.0.8",
    "dotenv": "^17.4.2",
    "ethers": "^6.16.0"
  }
}

• Confidence: 94% confidence
• Finding: The ethers dependency is not fully pinned due to the caret specifier, so future installs may fetch different code than originally tested. Because ethers is a core blockchain library, unexpected upstream changes could affect transaction construction, signing, or network interaction and introduce supply-chain or reliability risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.