Crypto charting with USD pricing (1s)

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:22 PM UTC
• Version:
  1.0.5

Overview

This skill is a disclosed Bitquery crypto charting integration that uses a required API key and WebSocket connection as expected, with no evidence of hidden persistence or unrelated data access.

Install only if you intend to connect to Bitquery and are comfortable providing a Bitquery API key. Use a dedicated or revocable key if possible, avoid logging full WebSocket URLs, run in an isolated environment for shared or production systems, and rotate the key if you suspect it was exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 98% confidence
• Finding: The skill requires network access and reads a sensitive environment variable, but it does not declare corresponding permissions in metadata. This creates a transparency and policy-enforcement gap: installers and sandboxing systems may not be able to accurately assess or restrict what the skill can do before execution.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

from gql.transport.websockets import WebsocketsTransport

async def main():
    token = os.environ["BITQUERY_API_KEY"]
    url = f"wss://streaming.bitquery.io/graphql?token={token}"
    transport = WebsocketsTransport(
        url=url,

• Confidence: 94% confidence
• Finding: os.environ["BITQUERY_API_KEY"]

VirusTotal

66/66 vendors flagged this skill as clean.