mcp-crypto-data

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:32 AM UTC
• Version: 1.0.0

Overview

The skill appears to provide crypto-data MCP tools, but its install instructions execute an unpinned npm package and the package names, tool names, and environment variables are inconsistent across files.

Review before installing. Only use this skill if you trust the npm publisher and can pin the package to a reviewed exact version. Confirm which package name is authoritative, align the base URL environment variable, and understand that tool calls contact an external crypto API and may involve L402 micropayments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:21

Finding

Unpinned Third-Party Package Execution with Package Identity Mismatch

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21–24
Related Locations: package.json, line 2; README.md, lines 1 and 18–23
Vulnerability Type: Supply-chain risk caused by automatic execution of an unpinned npm package
Risk Level: High

Vulnerable Code

json

{
  "mcpServers": {
    "crypto-data": {
      "command": "npx",
      "args": ["-y", "@vbotholemu/mcp-crypto-data"],
      "env": {
        "L402_API_BASE_URL": "https://api.nautdev.com"
      }
    }
  }
}

The local package manifest identifies the package as:

json

{
  "name": "@vbotholemu/mcp-crypto-data",
  "version": "1.0.0"
}

However, the README advertises a different package identity:

markdown

# @blue-trianon/mcp-crypto-data

json

{
  "mcpServers": {
    "crypto-data": {
      "command": "npx",
      "args": ["-y", "@blue-trianon/mcp-crypto-data"],
      "env": {
        "NAUTDEV_BASE_URL": "https://api.nautdev.com"
      }
    }
  }
}

Technical Analysis

The Skill configuration invokes npx with the -y option and a package name that has no exact version. This causes npm to resolve, download, and execute the registry version available at invocation time without interactive confirmation. Consequently, the code executed by users can differ from the source code reviewed in this audit.

The package identity is also inconsistent: SKILL.md and package.json refer to @vbotholemu/mcp-crypto-data, while README.md instructs users to execute @blue-trianon/mcp-crypto-data. This discrepancy makes it unclear which publisher and artifact are authoritative and increases the possibility of executing an unintended, replaced, compromised, or similarly named package.

This is classified as an insecure dependency rather than confirmed embedded malicious code. The reviewed TypeScript source contains no demonstrated malicious payload, but the documented installation path crosses an unpinned external supply-chain boundary.

Attack Path

...[truncated 1500 chars]

Remediation

View remediation

Remediation Suggestions

1. Establish one authoritative npm package name and make SKILL.md, README.md, and package.json consistent.
2. Pin the command to an exact reviewed version, for example:

   json

   "args": ["@vbotholemu/mcp-crypto-data@1.0.0"]
   

3. Avoid npx -y for security-sensitive setup because it suppresses confirmation before downloading and executing packages.
4. Prefer installation through a lockfile-backed deployment process and verify registry integrity metadata.
5. Publish reproducible build artifacts generated from the audited source and document how users can verify package provenance.
6. Protect the publisher account with multi-factor authentication, restricted release tokens, provenance attestations, and controlled CI publishing.
7. Review npm lifecycle scripts and the complete packaged artifact before each release.
8. Correct the environment-variable mismatch between SKILL.md (L402_API_BASE_URL) and src/index.ts (NAUTDEV_BASE_URL) so users can reliably enforce the intended endpoint.
9. Align the documented tool names with the implemented names to prevent users or agents from invoking unintended interfaces.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Yes, this is a mismatch. The declared description promises several concrete crypto-data capabilities, but the provided code chunk contains no functional logic at all—only an empty module declaration. There is no evidence of API calls, data processing, triggers, or resource access consistent with the stated purpose. Therefore, the actual behavior represented by this code does not match the declared functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README describes external API usage and mentions L402 micropayments, but it does not clearly warn users that tool invocations transmit request data to a third-party cryptocurrency service and may automatically trigger paid requests. In an agent setting, missing disclosure can cause unintended data sharing and unexpected financial charges, especially when tools are invoked autonomously.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares environment and network capabilities but does not restrict tool scope with explicit permissions or allowed-tools. In agent environments, this increases the attack surface because a broadly scoped skill can make outbound requests and consume environment-provided configuration without clear least-privilege boundaries.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill installs and runs an npm package via npx without pinning an immutable version, allowing the executed code to change over time or be replaced by a compromised upstream release. This creates a supply-chain risk where future executions may fetch malicious code with the same skill invocation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill permits all outbound API requests to be redirected by setting NAUTDEV_BASE_URL, with no allowlist or validation tying requests to the documented crypto/L402 provider. In an agent environment, this broadens the skill from a narrowly scoped market-data client into a generic outbound HTTP client to attacker-controlled infrastructure, enabling data exfiltration, response spoofing, or abuse of the agent's network position.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency uses a caret range, which allows newer minor/patch releases to be installed without an explicit review. In a security-sensitive tool that fetches external crypto-related data, this weakens supply-chain control and can result in unintentionally pulling a vulnerable or compromised SDK version during install or rebuild.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json

"author": "Blue-Trianon-Ventures",
  "license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.1",
    "zod": "^3.23.0"
  },
  "devDependencies": {

Unverifiable Dependency: @modelcontextprotocol/sdk has 3 known advisory(ies) (CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport); CVE-2026-0621 (Anthropic's MCP TypeScript SDK has a ReDoS vulnerability); CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The manifest does not pin @modelcontextprotocol/sdk, and the package family has multiple known advisories, including cross-client data leakage and DNS rebinding-related issues. Because this skill is an MCP tool that likely exposes data over the MCP SDK, unresolved SDK flaws are more relevant than usual: they could affect confidentiality, client isolation, or network trust assumptions depending on the resolved version.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The zod dependency is specified with a caret range, so different environments may resolve to different releases over time. This creates a low-severity supply-chain risk because a later vulnerable or malicious publication could be consumed without a manifest change.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.1",
    "zod": "^3.23.0"
  },
  "devDependencies": {
    "typescript": "^5.7.0",

Unverifiable Dependency: zod has 1 known advisory(ies) (CVE-2023-4316 (Zod denial of service vulnerability)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 82% confidence

Finding

zod has had a denial-of-service advisory, and the unpinned range makes it impossible to verify whether installs are using a fixed or affected release. If this skill validates untrusted API parameters or user input with vulnerable schemas, a crafted input could trigger excessive processing and reduce service availability.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 30)May include surrounding context.

json

"zod": "^3.23.0"
  },
  "devDependencies": {
    "typescript": "^5.7.0",
    "@types/node": "^22.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 31)May include surrounding context.

json

},
  "devDependencies": {
    "typescript": "^5.7.0",
    "@types/node": "^22.0.0"
  }
}