Unclaimed SOL Scanner

• Outcome: Pass
• Latest audit: Jun 18, 2026 at 1:25 AM UTC
• Version:
  1.0.2

Overview

This skill is a disclosed, read-only Solana wallet lookup that sends a public wallet address to Unclaimed SOL’s API after user consent.

Install only if you are comfortable sharing the public Solana wallet address you scan with Unclaimed SOL. The skill should ask before making the API request, and you should not provide private keys, seed phrases, mnemonics, or signing approval to use it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the agent to execute a shell command (`bash {baseDir}/scripts/scan.sh <wallet_address>`) but does not declare shell/code-execution permissions. Undeclared execution capability is dangerous because it hides the true trust boundary from the platform and reviewers, and if the script or its inputs are modified it could enable unintended command execution or external network access without explicit approval.

VirusTotal

63/63 vendors flagged this skill as clean.