妖币信号探测器(可搭配自动交易系统)

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 1.0.2

Overview

This crypto analysis skill appears purpose-aligned, but it needs review because it can make paid remote calls over plaintext HTTP and sends a user identifier without clear consent controls.

Install only if you are comfortable with paid crypto-analysis requests going to this remote service. Confirm each call before running it, do not put real account credentials or sensitive identifiers in DEMON_USER_ID, and treat results as advisory rather than connecting them directly to trading automation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tainted flow: 'API_HOST' from os.environ.get (line 5, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

headers = {}
    if user_id:
        headers["X-User-Id"] = user_id
    resp = requests.get("{}/analyze/{}".format(API_HOST, ccy.upper()), headers=headers, timeout=120)
    return resp.json()

• Confidence: 92% confidence
• Finding: The remote endpoint is taken directly from an environment variable and used for outbound requests without validation, allowing redirection to an arbitrary host if the runtime environment is influenced. In this skill, that also means the tool may send user identifiers and query data to an attacker-controlled server over plain HTTP, enabling data exfiltration and man-in-the-middle tampering.

Tainted flow: 'API_HOST' from os.environ.get (line 5, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

headers = {}
    if user_id:
        headers["X-User-Id"] = user_id
    resp = requests.get("{}/scan".format(API_HOST), headers=headers, timeout=180)
    return resp.json()

• Confidence: 92% confidence
• Finding: This request has the same issue: an untrusted environment-controlled base URL determines where scan results and headers are sent. Because scan mode appears to contact the backend automatically, a manipulated environment can silently redirect traffic to an attacker-controlled endpoint and capture metadata or return malicious JSON.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger phrase for questions like '现在有什么机会' or '有什么妖币' is very broad and can capture common market-discussion queries that users may not intend to route to a paid third-party trading service. In this skill, broad matching is more risky because each invocation incurs automatic billing and sends requests to a remote backend.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill states elsewhere that the core engine runs on a cloud server and that each call is billed automatically, but the user-facing description and invocation guidance do not clearly warn at the decision point that user queries are being sent to a remote service. This undermines informed consent and can expose sensitive trading interests or prompts to a third party without sufficient notice.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The client transmits a user identifier in the X-User-Id header to a remote service without any user-facing disclosure or consent flow. In the context of a market-analysis skill backed by a third-party server, this creates a privacy risk and may expose trackable identifiers to an external operator.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: Scan mode performs automatic remote transmission to the backend with no warning that data is leaving the local environment. Given the skill description, users may assume local analysis, but the script is only a thin client and silently depends on an external server, which increases privacy and trust concerns.

VirusTotal

58/58 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.