DeFi Risk Scanner

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:30 PM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed DeFi research helper that runs a local shell script to query public market APIs, with no evidence of hidden persistence, credential use, or destructive actions.

Install only if you are comfortable running a bash helper that uses curl and jq and sends the target protocol or token address to public API services. Treat its risk score as an educational screening aid, not financial advice, and verify important conclusions with independent sources before acting.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs users to invoke a shell script (`./scripts/risk-check.sh`) but does not declare any corresponding permissions. Undeclared shell capability is risky because it can lead to execution of local commands, external network access, or unsafe handling of user-controlled inputs without the platform surfacing that capability for review and containment.

VirusTotal

63/63 vendors flagged this skill as clean.