Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- index-sol-safe.js:9
Security audit
sol-bsc-dev-monitor-skill
Security checks across malware telemetry and agentic risk
Overview
The monitor mostly matches its stated purpose, but it embeds a live billing API key and payment-charge logic that users should review carefully before installing.
Review the billing implementation before installing. The monitor code does not show private-key use or automatic trading, but the packaged source contains a hardcoded SkillPay API key and charge logic, and the package appears incomplete for npm-based execution.
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- billing-final.js:9
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- billing.js:10
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:9