Crypto Wallets & Payments for AI Agents

• Analyzed: May 12, 2026, 3:13 AM
• Findings: 1
• Version: 0.1.7
• Hash: 63fef9e05afa8617dfa41e5653bd0ac7d012f365e86647c10eb5bd629ca9c2d6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its inherent high-risk capabilities and supply chain dependency. It explicitly instructs the AI agent to handle cryptocurrency private keys, including generating new ones and saving them to a '.env' file, or asking the user for existing keys, which are then used for financial transactions (transfers, swaps). While these instructions are transparent and aligned with the stated purpose, the handling of such sensitive credentials is a significant risk. Furthermore, the skill relies on executing an external, unvetted npm package (`@onlyswaps/mcp-server`) via `npx` (as seen in SKILL.md), introducing a substantial supply chain vulnerability where the remote code could potentially be malicious, despite the local files not explicitly instructing harmful behavior.