Babylon

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:56 AM UTC
• Version: 1.3.1

Overview

This is a real Babylon API client, but it gives an agent broad account-changing and value-bearing powers beyond the short description, without built-in confirmation controls.

Install only if you trust this skill to act on your Babylon account, including trades and other account-changing actions. Keep BABYLON_URL unset unless you control the endpoint, protect and rotate BABYLON_API_KEY like a password, and require explicit human approval before trades, transfers, messaging, profile changes, moderation, post deletion, or ban/escrow-related actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill requires an API key and performs networked actions against a remote service, but it does not declare explicit permissions for those sensitive capabilities. This weakens reviewability and policy enforcement because a caller may not realize the skill can read secrets from the environment and invoke state-changing remote actions such as trading, posting, messaging, or transfers.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose frames the skill as a prediction-markets client, but the documented toolset includes materially broader and more sensitive capabilities such as leveraged perpetuals trading, messaging, moderation, profile changes, points transfers, payments-related actions, and ban appeals. This mismatch can mislead users, orchestrators, or policy layers into granting trust or invoking the skill in contexts where they would not consent to those additional account-affecting actions.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documentation presents a relatively narrow trading/posting skill, yet the capability surface spans general social, moderation, referral, payment, and appeal functions. Overbroad undocumented scope increases the chance of unsafe delegation, accidental misuse, and underestimation of the blast radius if the skill is triggered by an agent with the user's API key.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The reference materially expands the skill’s apparent capability set beyond the manifest’s stated trading/feed/portfolio/leaderboard scope, including moderation, messaging, payments, favorites, and account-management actions. In an agent setting, this creates dangerous authority ambiguity: an assistant or reviewer may assume the skill can legitimately invoke sensitive operations that users did not expect, increasing the chance of overbroad account actions and privacy-impacting misuse.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Admin-only escrow and moderation-payment capabilities are highly privileged and are not justified by the stated Babylon gameplay/trading use case. Their presence in the skill reference normalizes access to sensitive financial and moderation actions, which could enable unauthorized fund handling or privileged abuse if the skill or downstream agent is over-permissioned.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Private chat and messaging capabilities exceed the manifest’s stated trading/feed use case and introduce access to potentially sensitive interpersonal data and state-changing communication actions. In a user-facing agent, undocumented messaging powers can lead to privacy violations, impersonation-like behavior, spam, or unintended outbound communications.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The client exposes a much broader set of account-mutating capabilities than the skill metadata suggests, including messaging, moderation, referrals, favorites, profile updates, and points transfer. This scope expansion increases the attack surface and raises the risk that an agent or user invokes sensitive actions that were not expected or consented to under the stated trading/feed use case.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Direct messaging and group-management features are unrelated to the stated prediction-market workflow and enable private outbound communication from the user's authenticated account. In an agent context, these functions could be abused for spam, impersonation, social engineering, or exfiltration through user-controlled chat content.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill advertises capabilities that can spend funds, open/close positions, send messages, edit social content, and transfer points, but it lacks clear warnings about financial loss, irreversible account actions, or the need for confirmation before side-effecting operations. In an agent setting, insufficient warnings make accidental harmful execution more likely, especially because an authenticated API key is used for all actions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The API reference lists many state-changing operations affecting funds, posts, follows, chats, moderation state, and transfers without warning about irreversible or account-impacting effects. In an autonomous or semi-autonomous agent context, lack of safety guidance materially raises the risk of accidental trades, transfers, deletions, or social actions performed without meaningful user awareness.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The authentication guidance shows transmission of per-user API keys but omits warnings about credential sensitivity, storage, logging, and replay/exposure risks. For agent integrations, such omissions make it more likely that developers will embed, echo, or mishandle live account credentials, enabling account takeover or unauthorized API use.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The A2A authentication section documents both server and user API key modes without highlighting that server-scoped credentials may carry elevated privileges. In an agent ecosystem, failing to distinguish privilege boundaries can cause developers to use broad server keys in general-purpose assistants, dramatically increasing blast radius if the key or agent is abused.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The trading functions perform real account-affecting market actions immediately with authenticated requests and no confirmation, bounds checks, or safety interlocks. In an agent-driven setting, prompt injection, misunderstanding, or accidental invocation could directly spend funds, alter positions, or realize losses on the user's account.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: These social write operations can post, delete, like, comment, and otherwise modify remote account data without any warning or confirmation. In an autonomous or semi-autonomous agent context, this can cause reputational harm, unwanted interactions, or destructive account changes through accidental or manipulated tool use.

VirusTotal

65/65 vendors flagged this skill as clean.