Security audit

graph-advocate

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed remote blockchain data router with optional paid calls; it has documentation rough edges but no hidden local execution, persistence, or deceptive behavior was found.

Install only if you are comfortable sending blockchain questions, wallet addresses, and trading intent to graphadvocate.com and related data providers. Keep x402 payment approval interactive, use a low-balance wallet with spend caps, and store any Token API or Graph API credentials in a proper secret store rather than in prompts or logs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documentation gives conflicting guarantees about what the service returns: one section says the skill returns live data directly, while the endpoint description for `/chat` says it only returns routing instructions and never the data itself. This ambiguity can cause downstream agents to trust the wrong interface, mishandle sensitive queries, or accidentally invoke different endpoints with different privacy, billing, or execution properties than expected.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: Labeling the skill as 'instruction-only' is misleading because the rest of the document describes sending user queries to external services and retrieving live data from remote endpoints. Security reviewers or automated agents may classify it as low-risk local guidance when it is actually a networked skill that transmits user input off-box, weakening informed consent and policy enforcement.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The default-mode section says a plain-English question yields live data, but the endpoint docs say `/chat` never returns the data itself. An integrating agent could choose the wrong endpoint and assume it is safe, free, or data-returning when it is not, leading to privacy mistakes, broken autonomy logic, or unintended escalation to paid/executing routes.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The document instructs use of paid third-party `/hyperliquid/*` endpoints and includes request bodies containing wallet or vault identifiers, but it does not warn that these identifiers will be transmitted to an external service or that requests incur charges from the first call. In an agent context, this omission can cause silent privacy leakage and unexpected billing if the agent routes user requests automatically.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation explicitly tells users how to authenticate and where to obtain an API key/JWT, but provides no warning about secret handling, storage, or redaction. In an agent-skill context, this increases the chance that credentials are pasted into prompts, logs, transcripts, or other insecure channels, leading to unintended disclosure and unauthorized API use.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The description is extremely broad ('Ask any blockchain question in plain English') and spans many domains, which can cause the orchestrator to invoke this skill for loosely related prompts without strong trigger boundaries. In a routing skill that forwards requests to external blockchain data services, overbroad activation increases the risk of unintended invocation, unnecessary data sharing, and misrouting of sensitive or finance-related user queries.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/subgraph-registry.md:8

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:100