market_test_price

• Outcome: Pass
• Latest audit: May 28, 2026 at 4:50 AM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed OKX token-price helper that uses OKX credentials only to sign the expected price API request.

Use this only with an OKX API key you are comfortable using for market-data requests, keep the secret and passphrase out of chats and logs, and remember that queried token addresses are sent to OKX.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares required credentials and uses code that accesses environment variables and makes outbound network requests, but the metadata only specifies allowed tools and does not clearly declare these sensitive capabilities as permissions. This creates a transparency and governance gap: an agent or reviewer may underestimate that the skill can access secrets and transmit authenticated requests to an external service.

VirusTotal

58/58 vendors flagged this skill as clean.