Funding Rate Scanner

• Outcome: Pass
• Latest audit: May 28, 2026 at 7:54 AM UTC
• Version:
  1.0.2

Overview

This skill only fetches public Binance Futures market data and prints funding-rate analysis, with no trading, credential use, persistence, or local data access found.

Install only if you are comfortable with a Node.js skill making public Binance Futures API requests. Treat the output as informational, verify market data independently, and do not connect separate exchange-account or trading tools without explicit human approval because leveraged crypto trading can be high risk.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises that no API key is needed and its documented usage invokes Node.js scripts that scan Binance Futures and monitor coins, which implies outbound network access. If the skill does not declare required network permissions, users and platforms may be misled about the capability surface, reducing transparency and weakening permission-based security review. In this context, network access is expected for the stated functionality, which makes the issue less suspicious than hidden exfiltration logic, but it is still a real security and governance problem.

VirusTotal

66/66 vendors flagged this skill as clean.