Crypto Market Strategist

• Outcome: Pass
• Latest audit: Jul 23, 2026 · 11:43 PM UTC
• Version: 1.0.0

Overview

This skill appears to perform disclosed public crypto market analysis and local saving, with dependency and storage details users should review before installing.

Before installing, understand that this skill will run Python, contact public Deribit, Hyperliquid, and Polymarket endpoints, and save market snapshots and strategy-card JSON locally. It does not trade or ask for credentials. Use a patched MCP dependency version and set CRYPTO_STRATEGY_OUTPUT_DIR if you want the saved files somewhere specific.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions, but its documented behavior clearly includes running Python, accessing network resources, and saving observations locally. That mismatch matters because users and policy systems may treat the skill as low-risk/read-only when it can actually perform file writes and external data retrieval, increasing the chance of unintended data persistence or unreviewed execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill presents itself as a narrow, read-only single-asset analysis tool, but the finding indicates broader behavior: persistent bundle storage, loading prior local data, saving strategy artifacts, and exposing wider management functions. This discrepancy is dangerous because operators may approve or run the skill under a much narrower trust model than its real capabilities, enabling unexpected data retention, filesystem interaction, and expanded attack surface.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The server persists collected market data and manifests to local disk even though the skill is framed as read-only research. This creates an undeclared side effect: user data, API responses, and analysis artifacts accumulate on the host filesystem, which can leak sensitive usage patterns or violate operator expectations in restricted environments.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Research bundles are written to disk automatically without an explicit user-facing warning at save time. Silent persistence is dangerous because operators may assume the tool is ephemeral/read-only, leading to unintended retention of market data, analysis context, and filesystem artifacts on shared or monitored machines.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: save_strategy_card writes a JSON strategy card to local storage without a confirmation step or prior warning in the code path. In an agent setting, this can create unexpected durable artifacts containing trading analysis and bundle references, which may be sensitive or undesirable on the host system.

Known Vulnerable Dependency: mcp==1.28 — 2 advisory(ies): CVE-2026-59950 (MCP Python SDK: WebSocket server transport does not support Host/Origin validati); CVE-2026-59950 (MCP Python SDK: WebSocket server transport does not support Host/Origin validati)

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: mcp==1.28

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.