KaspaCom LFG MCP

Use KaspaCom LFG Launchpad through the KaspaCom DeFi MCP/CLI for launch discovery and launch-token trading on IGRA and Kasplex. Trigger on active launch look...

Security Scan

The skill claims to operate a CLI for KaspaCom launchpad and shows transaction commands, but it omits how transactions are signed/authorized and asks you to install an external npm package without declaring the needed credentials or install metadata — this mismatch is concerning.

Purpose & Capability

The name/description match the SKILL.md examples (discovery and buy/sell on KaspaCom/Kasplex). However, the skill shows transaction commands that necessarily require signing keys or a wallet and RPC/provider configuration — none of which are declared in the skill's requirements or described in the instructions. That missing credential/config requirement is disproportionate to what the manifest lists and creates an incoherence.

Instruction Scope

The SKILL.md tells the agent to globally install an npm package and run CLI commands including buyLaunchToken/sellLaunchToken. These are potentially fund-moving actions. The instructions do not explain how to provide or protect private keys, which account will be used, or which RPC endpoints will be contacted. The scope is therefore incomplete and could lead to accidental transactions or credential exposure.

Install Mechanism

There is no formal install spec in the registry metadata, but SKILL.md recommends `npm i -g @kaspacom/defi-mcp`. Installing a global npm package is plausible for this purpose, but it is an external package (not tied to a vetted URL in the manifest) and npm packages can run install-time scripts. This increases risk slightly versus an instruction-only skill that never touches external packages.

Credentials

The skill declares no required environment variables or credentials, yet the runtime examples imply the need for account private keys, wallet access, and network/RPC configuration. Requiring no env vars is disproportionate and ambiguous; the skill should explicitly declare what secrets/config are necessary and where they are read from.

Persistence & Privilege

The skill does not request always:true, has no install spec that writes persistent files on its own in the registry metadata, and does not claim to modify other skills or system-wide agent settings. Autonomous invocation remains possible (default), but that is normal and not in itself an extra privilege here.

What to consider before installing

Before installing or using this skill: (1) Verify the npm package @kaspacom/defi-mcp exists on the public registry and inspect its source repository (look for README, owner, recent commits, and absence of suspicious install scripts). (2) Do NOT run buy/sell commands until you know how the CLI signs transactions — ask the author which environment variables or wallet files are required and where private keys are stored or prompted for. (3) Prefer testing read-only commands first and run any install in an isolated environment or container. (4) If you must provide keys, use a limited-purpose account with minimal funds and hardware-backed keys where possible. (5) Additional information that would change this assessment: a published package homepage/repo, a manifest showing required env vars (e.g., PRIVATE_KEY, RPC_URL), or explicit instructions on safe key handling and network endpoints.

Focused skill for KaspaCom LFG Launchpad via MCP/CLI.

Install

npm i -g @kaspacom/defi-mcp

Read-only examples

kaspacom-defi getActiveLaunches --network kasplex
kaspacom-defi getProtocolInfo --network kasplex

Transaction examples

kaspacom-defi buyLaunchToken --token 0xTOKEN --amountIn 100 --network kasplex
kaspacom-defi sellLaunchToken --token 0xTOKEN --amountIn 1000000 --network kasplex

Best for

• Active launch discovery
• Bonding curve token access
• Launchpad buy/sell flows
• AI-agent launchpad integrations