Security audit

Smart Money Miner

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed crypto wallet analysis tool that fetches public token and wallet-trading data, writes a local JSON result file, and does not show deceptive or destructive behavior.

Install only if you want a crypto-analysis skill that makes external API requests and writes a local results JSON file. Review the generated wallet lists before acting on them financially, and consider narrowing the trigger language if you maintain the skill to avoid accidental activation for non-crypto requests.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documentation clearly describes capabilities to read local files (skip list/results), write output files, and access external APIs, yet no permissions are declared. This creates a transparency and governance gap: an agent or reviewer cannot reliably understand or constrain what the skill may do, increasing the chance of unintended file or network access in deployment.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrases are broad enough to match generic requests like finding profitable traders or good addresses outside the intended PumpFun/Four Meme wallet-analysis workflow. Over-broad activation can cause the wrong skill to run, exposing network/file capabilities in contexts where the user did not intend this specialized crypto-analysis behavior.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The applicability section repeats broad activation criteria without clear boundaries, making accidental invocation more likely. In a skill that performs API-driven analytics and writes result files, misrouting ordinary requests into this workflow can lead to unnecessary external requests, incorrect outputs, or privacy surprises.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.12/site-packages/pip/_vendor/distlib/wheel.py:131

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.12/site-packages/pip/_vendor/pygments/formatters/__init__.py:91

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.12/site-packages/pip/_vendor/pyparsing/results.py:57

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.12/site-packages/pip/_vendor/typing_extensions.py:1251

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.12/site-packages/pip/_internal/network/auth.py:93

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.12/site-packages/pip/_vendor/requests/adapters.py:214

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.12/site-packages/pip/_vendor/requests/sessions.py:323

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/connection.py:423

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/connectionpool.py:988

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.py:231

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/contrib/socks.py:102

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.12/site-packages/requests/adapters.py:257

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.12/site-packages/requests/sessions.py:322

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.12/site-packages/urllib3/connection.py:807

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.12/site-packages/urllib3/connectionpool.py:1073

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.12/site-packages/urllib3/contrib/socks.py:116

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.12/site-packages/pip/_internal/network/session.py:304

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.12/site-packages/pip/_vendor/distlib/wheel.py:183

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.12/site-packages/pip/_vendor/truststore/_macos.py:353

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.12/site-packages/pip/_vendor/truststore/_windows.py:443

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/connection.py:454

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py:113

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/contrib/securetransport.py:795

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/util/ssl_.py:137

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.12/site-packages/urllib3/connection.py:951

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.12/site-packages/urllib3/contrib/pyopenssl.py:84

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.12/site-packages/urllib3/util/ssl_.py:353