Bitfinex Lending Monitor

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:15 PM UTC
• Version:
  0.1.0

Overview

This skill does what it claims: it locally reads Bitfinex funding data using user-provided API credentials and prints a lending summary.

Install only if you want local Bitfinex funding reporting. Use a dedicated read-only Bitfinex API key limited to wallet, funding, and ledger/history reads, and do not grant trading, transfer, or withdrawal permissions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs users to export Bitfinex API credentials into environment variables and then run a script that uses network access, but the skill declares no permissions. This creates a transparency and governance gap: users and platforms cannot accurately assess that the skill will access secrets from the environment and send authenticated requests to an external service, increasing the risk of accidental secret exposure or unsafe execution in broader agent environments.

VirusTotal

65/65 vendors flagged this skill as clean.