Meme Coin Scanner

• Outcome: Review
• Latest audit: May 29, 2026, 9:25 PM
• Version:
  2.0.0

Overview

Review recommended because the package advertises a meme-coin scanner but also includes an undocumented security utility with unrelated commands and local input logging.

Install only after reviewing the bundled scripts. Use scripts/meme.sh as an informational market-data aid, not as complete scam detection or financial advice. Avoid using scripts/script.sh for secrets, passwords, wallet data, API keys, or private text, and prefer a version that removes the unrelated utility script or documents and scopes it clearly.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill advertises command-driven token scanning functionality that likely requires outbound network access, yet no permissions are declared. Undeclared network capability weakens transparency and consent boundaries, making it harder for users or platforms to assess what external services may be contacted and what data may be transmitted.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The reported mismatch between the stated meme-coin scanning purpose and broader hidden security-tooling behavior is a strong indicator of deceptive packaging. A skill presented as a niche crypto scanner but containing unrelated audit, hardening, encryption, password, logging, and secondary security CLI capabilities could be used to perform actions outside user expectations, increasing the risk of unauthorized system inspection, persistence, or misuse.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script’s stated purpose and implemented commands are for local security scanning, hardening, hashing, encryption, and password generation, which do not match the advertised meme coin risk-scanning capability. This is dangerous because the skill is materially misrepresented: users may install and trust it for one purpose while it performs unrelated security-oriented actions and collects local interaction history, a classic indicator of deceptive packaging.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Providing encryption, hashing, password generation, and compliance helpers inside a meme coin scanner is unjustified and inconsistent with the claimed domain. In this context, the mismatch increases suspicion because such capabilities can be used to build user trust, encourage unsafe security workflows, or hide the true purpose of the skill while exposing users to low-quality or misleading security functions.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The inline comments and help output explicitly present the tool as a generic security scanning and hardening utility rather than a meme coin scanner. This discrepancy is dangerous because deceptive documentation is a strong signal of repackaged or intentionally disguised functionality, making it easier to socially engineer users into executing a tool they do not actually understand.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The password generator uses Python’s random.choices, which relies on a non-cryptographic PRNG and is unsuitable for generating security-sensitive passwords or secrets. Because the command is presented as a password generator without any warning, users may rely on weak output for real credentials, leading to compromised accounts or reused insecure secrets.

VirusTotal

66/66 vendors flagged this skill as clean.