Crypto Radar

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.1

Overview

This appears to be a straightforward crypto market quote skill that contacts public finance APIs for price data and does not show credential access, persistence, or destructive behavior.

Install if you are comfortable with the skill contacting Yahoo Finance, CoinGecko, and Binance to retrieve public market data. Do not treat its output as financial advice, and prefer a version that clearly documents all external endpoints and removes the inaccurate sensitive-credentials metadata tag.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill includes code that performs outbound network access to Yahoo Finance and CoinGecko, but no declared permissions are shown. Undeclared capabilities weaken the trust boundary for users and host platforms because the skill can transmit requests externally without transparent permission scoping.

External Transmission

Medium

• Category: Data Exfiltration

Content

def get_crypto_markets():
    ids = "bitcoin,ethereum,solana,binancecoin,ripple,cardano,dogecoin"
    url = f"https://api.coingecko.com/api/v3/coins/markets?vs_currency=usd&ids={ids}&order=market_cap_desc&per_page=10&sparkline=false&price_change_percentage=24h"
    r = requests.get(url, headers={"User-Agent": "Mozilla/5.0"}, timeout=10)
    return r.json()
    # 返回: price, market_cap, total_volume, price_change_percentage_24h

• Confidence: 88% confidence
• Finding: https://api.coingecko.com/

VirusTotal

58/58 vendors flagged this skill as clean.