Security audit
Openapi Contract Driven
Security checks across malware telemetry and agentic risk
Overview
The reviewed file is a non-executable coding-workflow skill, but the surrounding listing metadata describes a crypto token launchpad with wallet and transaction-related capabilities, so it should be reviewed before install.
Review the exact version and listing before installing. The file reviewed here does not appear to perform crypto, wallet, credential, persistence, or network actions, but the mismatch between the artifact and high-impact listing metadata could mislead users about what the skill is for.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.