Crypto Tools

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:31 PM UTC
• Version: 1.0.0

Overview

This is a markdown-only crypto reference skill with disclosed public data APIs and safety disclaimers, though users should be cautious with tax and wallet-transfer guidance.

Use this as an informational crypto reference. Do not share seed phrases or private keys, avoid letting an agent execute wallet transfers automatically, and consult a qualified tax or financial professional for personal decisions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · tools.md (reported line 125)May include surrounding context.

Address Validation

Ethereum/EVM

• 42 characters (0x + 40 hex)
• Checksum: mixed case encodes checksum
• Example: 0x742d35Cc6634C0532925a3b844Bc9e7595f4A9A1

Bitcoin

• Legacy (P2PKH): Starts with 1, 26-35 chars
• SegWit (P2SH): Starts with 3
• Native SegWit: Starts with bc1

Solana

• Base58, 32-44 characters
• Example: 7xKXtg2CW87d97TXJSDpbD5jBkheTqA83TZRuJosgAsU

Never: Send to wrong chain address (BTC to ETH address = lost)

---

Quick Formulas

Market Cap

text

Market Cap = Circulating Supply × Price
FDV (Fully Diluted) = Max Supply × Price

Liquidity Depth

text

If pool has $1M liquidity:
- $10k trade: ~1% slippage
- $100k trade: ~10% slippage
- $500k trade: ~50% slippage (don't)

APY vs APR

text

APR = Simple interest
APY = Compound interest

APY = (1 + APR/n)^n - 1
where n = compounding periods per year

Example: 10% APR compounded daily
APY = (1 + 0.10/365)^365 - 1 = 10.52%

---

Transaction CSV Export Format

For tax purposes,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sources.md (reported line 16)May include surrounding context.

bash

# Current price
curl "https://api.coingecko.com/api/v3/simple/price?ids=bitcoin,ethereum&vs_currencies=usd,eur"

# Historical (30 days)
curl "https://api.coingecko.com/api/v3/coins/bitcoin/market_chart?vs_currency=usd&days=30"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sources.md (reported line 19)May include surrounding context.

bash

# Current price
curl "https://api.coingecko.com/api/v3/simple/price?ids=bitcoin,ethereum&vs_currencies=usd,eur"

# Historical (30 days)
curl "https://api.coingecko.com/api/v3/coins/bitcoin/market_chart?vs_currency=usd&days=30"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sources.md (reported line 22)May include surrounding context.

bash

# Current price
curl "https://api.coingecko.com/api/v3/simple/price?ids=bitcoin,ethereum&vs_currencies=usd,eur"

# Historical (30 days)
curl "https://api.coingecko.com/api/v3/coins/bitcoin/market_chart?vs_currency=usd&days=30"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sources.md (reported line 66)May include surrounding context.

bash

# All protocols TVL
curl "https://api.llama.fi/protocols"

# Specific protocol
curl "https://api.llama.fi/protocol/uniswap"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sources.md (reported line 69)May include surrounding context.

bash

# All protocols TVL
curl "https://api.llama.fi/protocols"

# Specific protocol
curl "https://api.llama.fi/protocol/uniswap"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sources.md (reported line 72)May include surrounding context.

bash

# All protocols TVL
curl "https://api.llama.fi/protocols"

# Specific protocol
curl "https://api.llama.fi/protocol/uniswap"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sources.md (reported line 93)May include surrounding context.

bash

# Etherscan gas oracle
curl "https://api.etherscan.io/api?module=gastracker&action=gasoracle"
# Returns: SafeGasPrice, ProposeGasPrice, FastGasPrice

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file states 'Only realized matters for taxes' and later provides a tax-oriented CSV export format without any jurisdictional qualification. Tax treatment varies significantly by country and by transaction type, so presenting this as universal guidance can mislead users into incorrect reporting or noncompliance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.