Crypto Price Alerter

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.0

Overview

This skill appears to be a straightforward crypto price checker that fetches public CoinGecko market data and prints informational alerts, with no credential, trading, persistence, or local-data access behavior found.

Install this as an informational market-data helper, not as financial advice or an automated trading tool. Be aware it may activate too broadly because of generic trigger terms, and avoid adding wallet keys, exchange credentials, or trading permissions unless those changes are separately reviewed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The manifest includes broad trigger phrases such as "alert," "trading," and raw asset symbols like "BTC" and "ETH," which can match ordinary market conversation rather than a clear user request to invoke this specific skill. This can cause unintended skill activation, leading the agent to fetch external data or provide trading-oriented analysis in contexts where the user did not explicitly ask for it.

VirusTotal

64/64 vendors flagged this skill as clean.