Authenticate

• Outcome: Review
• Latest audit: May 29, 2026 at 9:23 PM UTC
• Version:
  0.1.0

Overview

This looks like a wallet-authentication skill, but its trigger scope appears too broad for sensitive wallet access.

Install only if you specifically use Finance District and expect the agent to authenticate an fdx wallet. Treat any wallet prompt as sensitive, confirm the destination and account, and avoid using this skill for generic login, setup, or connection requests outside that context.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill description is broadly phrased with generic triggers like 'log in', 'sign in', 'connect', 'set up', and 'configure', which can overlap with ordinary user requests outside the intended wallet-authentication context. This increases the chance of accidental invocation, causing the agent to initiate authentication flows or prompt for sensitive wallet access when the user meant something else.

VirusTotal

66/66 vendors flagged this skill as clean.