Kr Crypto Skill Publish

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:12 AM UTC
• Version: 1.5.0

Overview

This is a disclosed remote market/news data skill with paid API calls, and I did not find hidden local execution, persistence, credential access, or destructive behavior.

Review your MCP client's payment approval and privacy settings before installing. Use user-invoked mode and spending limits until you are comfortable with the billing flow, since paid calls may send topic parameters and standard HTTP metadata to the remote service.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: kr-crypto-intelligence
description: Korean crypto + news data + AI analysis for trading agents. 15 tools — dual-basis Kimchi Premium (official USD/KRW + USDT live rate) across 180+ tokens, exchange intelligence, AI sentiment analysis (world's first Korean-to-English), Global vs Korea divergence with structured AI breakdown, market alerts, plus Korean news (K-pop artists, semiconductor industry: Samsung/SK Hynix/HBM) translated to English with AI synthesis. x402 on Base, Polygon, and Solana. Every paid response includes a cryptographic receipt (ECDSA secp256k1) for agent accountability.
version: 1.5.0
homepage: htt

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `check_health` | (free) | Service status |

### REST API (Alternative)
GET https://api.printmoneylab.com/api/v1/market-read                     → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence-deep → $0.10
GET https://api.printmoneylab.com/api/v1/kr-news/semiconductor-summary   → $0.10
GET https://api.printmoneylab.com/api/v1/global-vs-korea-divergence      → $0.05

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly encourages agent invocation based on broad topical triggers such as Korean crypto markets, financial news, K-pop, and semiconductor news. In a paid remote-skill context, broad autonomous triggers can cause unintended tool activation, unnecessary external data disclosure, and repeated micro-charges without a narrowly scoped user request.

Static analysis

No suspicious patterns detected.