MuHaven RWA Portfolio (rehearsal)

• Analyzed: May 11, 2026, 2:42 PM
• Findings: 1
• Version: 0.1.0-rc.1
• Hash: 5c5247891363994de3d5181c2e5b0bca3569cbceb9ea51152044973cc4add7e0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The MuHaven RWA Portfolio skill is a highly secured MCP bundle with extensive hardening and transparent security controls. It implements a strict network egress allowlist (api.muhaven.app and muhaven.app), explicitly denies filesystem and process spawning permissions, and manages secrets via a separate broker daemon using the OS keychain. The implementation in dist/index.cjs includes runtime drift detection to ensure only the authorized tool subset is exposed, and the documentation (SKILL.md, README.md) details a robust three-tier confirmation architecture (OTP/Passkeys) for all state-mutating actions.