Security audit

Prism Alerts

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward crypto alert helper that fetches token data from a disclosed PRISM API and does not show hidden or destructive behavior.

Install only if you are comfortable sending alert queries to the PRISM endpoint. Treat any Telegram or Discord bot tokens as secrets, keep them out of committed files and logs, and avoid connecting these alerts directly to automated trading or public posting without your own confirmation and rate limits.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The skill documents bot tokens and channel IDs as environment variables without any guidance on secret handling, which can lead users to place credentials in plaintext files, commit them to source control, or expose them in logs. In a bot/integration context, leaked bot tokens can allow unauthorized control of Telegram or Discord bots and misuse of notification channels.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are generic trading-related terms such as 'pump fun trending' and 'new pump tokens', which can cause the skill to activate in loosely related conversations without clear user intent. In a trading/alert skill, unintended activation can lead to unwanted API calls, noisy alerting, or downstream automated trading/bot actions based on ambiguous prompts.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.