Crypto Alpha Scanner

• Outcome: Pass
• Latest audit: May 28, 2026, 12:23 PM
• Version:
  1.0.0

Overview

This appears to be a straightforward crypto market report tool that calls named public data APIs, with optional sharing and scheduling examples users should handle deliberately.

Safe to install for local crypto market reports if you are comfortable with outbound calls to the named public APIs. Do not use the Telegram pipeline unless you have inspected or written the missing helper script and understand it will send the generated report to Telegram using a bot token. Only add the cron entry deliberately, under a normal user account, with a log path you control.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises and demonstrates network-backed functionality (CoinGecko, Alternative.me, Polymarket) while declaring no permissions, creating a capability/metadata mismatch. This is dangerous because users and policy engines may trust the manifest to understand runtime behavior, and undeclared outbound network access can bypass review expectations or organizational controls.

VirusTotal

64/64 vendors flagged this skill as clean.