Solana Stablecoin Payments in Real-time

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Bitquery WebSocket tool for streaming public Solana USDC/USDT transfer data and does not show hidden data collection, persistence, or destructive behavior.

Install only if you intend to use Bitquery to monitor Solana stablecoin transfers. Use a dedicated Bitquery API key, avoid logging the full WebSocket URL, run in a virtual environment or container when practical, and use --timeout if you do not want a long-running stream.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill uses environment variables and outbound network access but does not declare corresponding permissions in its metadata, which weakens security transparency and informed consent for installers. In a skill ecosystem, undeclared capabilities can lead users to run code that accesses secrets and external services without clear upfront disclosure.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal