Security audit

Portfolio Risk Analyzer

Security checks across malware telemetry and agentic risk

Overview

This skill is openly built around crypto portfolio analysis, but running it can also trigger recurring wallet-funded token buybacks without strong safeguards.

Install only after reviewing or replacing the missing transaction helper scripts and disabling automatic buybacks by default. Use a dedicated low-balance hot wallet, never a main wallet key, add explicit approvals, limits, logs, and emergency stop controls, and document privacy handling for wallet, voice, SMS/email, and provider API data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill goes beyond passive portfolio analysis and introduces fee collection, automated token buybacks, and token-holder incentives tied to a specific asset. That materially increases risk because the tool can influence fund flows and execute trades, creating opportunities for financial loss, abuse, or conflicts of interest if users rely on the analyzer or operator-controlled automation.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The Solidity example claims to charge '$5 USDC' but actually checks msg.value, which is native currency, not USDC. This mismatch can cause incorrect payments, user confusion, and accidental overpayment or underpayment, especially across chains where native token value differs significantly from $5.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The server runs a scheduled shell command that performs an automated buyback, which is unrelated to the stated portfolio-analysis functionality and introduces direct financial side effects on the host. Any compromise of the script, execution environment, PATH, working directory, or deployment pipeline could turn this into arbitrary command execution or unauthorized fund movement on a recurring basis.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The API claims to grant access to users who either paid or hold BANKR, but the implementation ignores the supplied payment_tx and only checks token holdings. This creates broken access-control and business-logic flaws: legitimate paying users may be denied service, while the interface misleadingly suggests payment is validated when it is not.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The README instructs users to scan wallets and configure RPC endpoints and API keys, but it provides no warning about privacy, consent, or handling of sensitive wallet-analysis data. In a crypto context, wallet addresses, portfolio composition, and linked infrastructure credentials can be sensitive metadata that may expose users to profiling or targeted attacks if mishandled.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill collects wallet addresses by voice and offers SMS/email follow-up without any clear privacy notice, consent language, or data handling policy. Wallet addresses can be linked to a person's phone number or identity, enabling profiling, tracking, or unintended disclosure of financial information.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill instructs operators to provide a payment wallet private key directly via environment variables, without any prominent warning or guidance on secure key management. Because this key controls receipt of payments and execution of buybacks, compromise would enable theft of funds and unauthorized transactions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill describes fully automated buybacks and burns/distributions without clearly warning users that these actions move funds irreversibly on-chain. In a financial tool, omitting that warning is dangerous because users or operators may enable automation without understanding the loss potential, slippage, or inability to reverse mistaken transfers.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The service performs an automated subprocess-driven buyback without any user-facing warning, confirmation, or clear consent boundary, despite being presented as an analysis API. This hidden operational behavior increases risk because users and operators may not realize the service can trigger financial actions, and any misuse or compromise of the subprocess path can have recurring effects.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The manifest advertises broad finance-related capabilities such as payment-gateway, auto-buyback, token-gating, and voice-interface without any visible invocation constraints, approval boundaries, or safety conditions. In a crypto/DeFi context, vague capability declarations can enable overbroad routing, unexpected activation, or unsafe assumptions by users and orchestrators about what the skill may do with funds or wallet-related actions.

Known Vulnerable Dependency: express==4.18.2 — 2 advisory(ies): CVE-2024-43796 (express vulnerable to XSS via response.redirect()); CVE-2024-29041 (Express.js Open Redirect in malformed URLs)

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: express==4.18.2

Known Vulnerable Dependency: axios==1.6.5 — 10 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +7 more

High

Category: Supply Chain
Confidence: 98% confidence
Finding: axios==1.6.5

VirusTotal

53/53 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: server.js:253

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: server.js:11