Smart Money Pro
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill generally matches its stated purpose (on‑chain tracking + per‑call billing) but contains several inconsistencies that could cause unexpected billing or misuse (hardcoded API keys/IDs in source and README, mock data instead of real data integrations, and undocumented DEBUG env usage).
This skill mostly does what it says (on‑chain tracking with a per‑call fee), but several red flags warrant caution before installing or enabling it: 1) The repository/README and api/main.py include default SKILLPAY_API_KEY and SKILL_ID values embedded in source — do not use the skill with those defaults. Treat them as secrets: remove them from code, rotate them, or supply your own keys. 2) The implementation appears to return mocked data rather than calling the listed blockchain data providers; confirm whether the production integration is present and whether any additional API keys (Etherscan, Solana RPC, etc.) will be required. 3) DEBUG mode (not declared in SKILL.md) can bypass billing behavior in the code — check and set DEBUG=false in production. 4) The skill has no install instructions but includes Python dependencies; review and install requirements in a controlled environment rather than running untrusted code directly. Recommended next steps before use: inspect the full api/main.py (complete file) for any hidden network calls, remove any hardcoded keys, ask the author for provenance/hosting details, and test in an isolated environment with your own SkillPay credentials to verify billing behavior. If you cannot verify the provenance of the embedded API key, treat it as untrusted and do not rely on it.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
Static analysis findings are pending for this release.
VirusTotal
63/63 vendors flagged this skill as clean.