UEXX Data Cloud

• Outcome: Pass
• Latest audit: May 28, 2026 · 8:30 AM UTC
• Version: 1.0.0

Overview

This is a disclosed crypto market-data connector that contacts UEXX, creates or reuses a free API key, and stores that key locally; the main risks are privacy and credential hygiene, not malicious behavior.

Install this only if you are comfortable with crypto market-data questions being sent to UEXX Data Cloud and a free UEXX API key being stored locally. On shared systems, treat ~/.uexx-data-cloud/free_key.json as a secret and delete it when no longer needed. Avoid setting UEXX_DATA_BASE_URL unless you intentionally want to use another trusted endpoint.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tainted flow: 'req' from os.environ.get (line 27, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
    req = urllib.request.Request(BASE_URL + path, data=data, headers=headers, method=method)
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            return json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        try:

• Confidence: 97% confidence
• Finding: with urllib.request.urlopen(req, timeout=30) as response:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to run local Python scripts, reuse or obtain API keys, and contact an external service, yet it declares no permissions. This creates a transparency and policy-enforcement gap: operators and users cannot accurately assess that the skill can read environment state, access files, write key material/cache, and make network requests before activation.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This skill advertises market-data querying, but it also provisions credentials automatically as a side effect. That hidden capability expands trust and data-handling scope beyond what a user would reasonably expect, and in combination with network access and persistence it can create unauthorized account/bootstrap actions without informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code persists an API key under the user's home directory, creating long-lived credential material on disk for a skill that appears to be a simple data-query client. Persistent secrets increase the blast radius of local compromise, accidental backup/sync leakage, and cross-process access on shared systems.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README states that the skill will automatically apply for or reuse a Free API key by default, but it does not clearly warn users that this creates credentials tied to their environment and may contact a third-party service automatically. Silent credential creation and network registration can surprise users, create unwanted accounts or tracking artifacts, and violate expectations around consent and credential handling.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README documents storing the Free API key in ~/.uexx-data-cloud/free_key.json but does not warn about local secret persistence, file permissions, or multi-user host exposure. Persisting credentials in a predictable path without explicit disclosure increases the risk of accidental leakage through backups, shared systems, permissive permissions, or developer tooling.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The activation text is broad enough to match many ordinary cryptocurrency questions, which can cause the skill to trigger when the user did not explicitly request external data access. In this skill's context, overbroad routing is more dangerous because activation leads to automatic key acquisition/reuse and outbound requests to a third-party service.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The description does not warn users that the skill will automatically obtain or reuse an API key and send requests to an external domain. This undermines informed consent and can expose user queries, usage patterns, and locally stored credentials or identifiers to a third party without a clear user-facing disclosure.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The default prompt is a broad natural-language question that can cause the skill to be invoked in situations where the user did not explicitly request this specific data source. Because implicit invocation is enabled, this increases the chance of over-broad routing, unintended tool use, and silent acquisition or reuse of an API key without clear user intent.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The default prompt is written in Chinese, which biases the skill toward a specific language without confirming the user's preference. This can cause confusing or inappropriate invocation behavior and may reduce transparency around what the skill is doing, though it is primarily a safety/UX issue rather than a direct security exploit.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The client stores credential material locally without any visible warning, prompt, or disclosure to the user. Secret persistence without transparency is dangerous because users cannot assess retention, revoke consent, or protect the stored key appropriately, and it meaningfully changes the privacy/security profile of the skill.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code sends API credentials in outbound requests but provides no visible disclosure that a key will be transmitted to a remote service. In this skill context, that is more concerning because users likely expect passive market-data lookups, not hidden credential exchange and remote identity linkage.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.