crypto briefing

Security checks across malware telemetry and agentic risk

Overview

This skill fetches public crypto prices and news to produce a briefing, with no evidence of hidden data access, persistence, or destructive behavior.

Install this if you are comfortable with the agent browsing public crypto market and news sites. Use an isolated browser profile if you do not want normal browser state shared with those sites, and treat the generated predictions as informational rather than financial advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to browse multiple external websites and fetch market data, which is a network-capable behavior, but the skill metadata does not declare any corresponding permissions or constraints. Undeclared network access weakens reviewability and policy enforcement, making it easier for a skill to exfiltrate prompts, collect unvetted content, or access unexpected domains without transparent consent.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal