Security audit

FollowinMCP

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate market-data routing skill, but it needs review because it gives unsafe API-key setup guidance and can make broad external data calls from vague prompts.

Install only if you trust the Followin MCP services and are comfortable with external finance and crypto queries, including premium endpoints that may cost money or reveal research intent. Do not place real API keys in URL query strings; prefer secret storage or header-only authentication if the host supports it, and require clarification before broad market prompts fan out to multiple data sources.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The skill explicitly defaults ambiguous requests containing only '日报' to the crypto brief flow, which can misroute user intent when the request actually refers to macro, equities, or a general daily summary. In an agent setting, this can cause incorrect tool invocation and disclosure of irrelevant or sensitive domain-specific outputs, especially when routing decisions drive downstream MCP calls automatically.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill description explicitly claims broad default ownership of vague queries like “市场怎么样” and mandates that all “KOL喊单” queries must route here. This can cause over-capture of user requests that may belong to news, macro, sentiment, or other market-analysis skills, leading to incorrect tool selection and unnecessary exposure of premium trading-signal data. In an agent routing system, overly broad trigger ownership is a security-relevant policy issue because it weakens least-privilege routing and increases the chance of mis-execution.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger keywords include highly ambiguous terms such as “策略”, “KOL”, “仓位”, and “能不能做”, which are common in ordinary market conversation and not specific enough to this skill’s narrow data domain. Such generic triggers can cause accidental invocation on unrelated requests, creating routing confusion and expanding access to tools beyond what the user actually requested. In this finance context, that increases the chance of misleading outputs and cross-skill policy bypass.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The instruction to default to calling all three MCPs when user intent is ambiguous is the strongest risk in the file, because it authorizes broad tool access without clear user scoping. This violates least privilege and can turn vague prompts into multi-source premium data queries, increasing data exposure, unnecessary external calls, and the chance of returning irrelevant or overconfident analysis. In a routed agent environment, ambiguity should reduce tool use, not expand it.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list includes broad natural-language phrases such as generic Telegram/topic-discussion wording, which can cause this skill to activate for loosely related user requests. In an agentic routing context, overbroad triggering can misroute requests, invoke external MCP-backed data access unnecessarily, and bypass more appropriate skills, reducing reliability and potentially exposing user queries to unintended third-party services.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger examples include generic phrases like “宏观环境如何” and “现在几分”, which can match broad market or non-BTC conversations and cause the skill to activate outside its intended scope. Over-broad routing can misdirect user requests into this skill, producing irrelevant analysis or causing unnecessary access to external tools and data sources.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs users to place API keys directly in both the SSE URL query string and request headers. Query-string secrets are commonly exposed through logs, browser history, proxy telemetry, crash reports, and server access logs, increasing the chance of credential leakage and unauthorized use of the MCP services.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.