Slither Audit

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local Slither wrapper with minor documentation and dependency caveats, not evidence of hidden or malicious behavior.

Reasonable to install for local Solidity scanning if you trust the Slither/PyPI dependency. Consider installing slither-analyzer in an isolated environment, use it only on intended local contract files, and do not treat the unused detect.md prompt as part of the actual Slither-based analysis.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation instructs users to run shell commands such as pip install and python3 invocation, which indicates shell execution capability, but the skill metadata declares no permissions. This mismatch is a real security issue because permissionless appearance can mislead users or orchestrators about what the skill can do, reducing transparency and weakening permission-based controls.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill metadata claims it runs Slither static analysis, but the file only contains a generic LLM prompt for auditing Solidity code and does not invoke Slither or any deterministic scanner. This mismatch can mislead users about the assurance level, reproducibility, and coverage of the analysis, causing them to rely on a weaker or different security process than intended.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal