Security audit

RustChain MCP

Security checks across malware telemetry and agentic risk

Overview

The skill does what it claims, but it exposes financial, public-posting, credential-bearing, and agent-messaging actions with weak safety boundaries.

Review this skill before installing. Use it only with explicit human approval for transfers, gas deposits, uploads, comments, votes, registration, and outbound messages. Avoid passing secrets or private content through it unless TLS verification is fixed, because the code disables certificate validation while handling credentials and signed transaction data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The README advertises high-impact capabilities such as wallet creation, signed token transfers, content uploads, messaging, and gas deposits, but does not prominently warn that these actions may spend funds, publish public content, or have irreversible on-chain effects. In an agent skill context, this increases the chance that a user or autonomous agent invokes powerful tools without adequate confirmation, scope limits, or understanding of consequences.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises high-impact capabilities including wallet creation, token transfers, video uploads, agent messaging, and network registration, but provides no warning that these actions can create external side effects, spend assets, publish content, or interact with third-party networks. In an agent setting, this increases the risk of users or downstream agents invoking destructive or irreversible actions without informed consent or appropriate safeguards.

Missing User Warnings

Medium

Confidence: 75% confidence
Finding: The transfer tool triggers a real financial transaction immediately and exposes it as a normal callable MCP action without an explicit high-friction confirmation step or strong user warning. In agent environments, tools may be invoked through prompt injection, misunderstanding, or autonomous planning, so low-friction access to irreversible transfers increases the risk of unintended asset loss.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: This tool sends user-provided video metadata, a remote video URL, and optionally an API credential to an external service without clearly emphasizing that data and secrets leave the local environment. In an agent skill context, inadequate disclosure is risky because users may provide sensitive URLs, internal resources, or credentials without understanding the external transmission.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The registration flow returns a relay token that authorizes heartbeats and message sending, but the code only says to save it, not that it is a sensitive secret. In LLM/agent ecosystems, returned tool outputs are often logged, surfaced to users, or reused by other components, so failing to treat the token as a credential can lead to account impersonation or unauthorized messaging.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: This tool forwards arbitrary message content to an external Beacon relay endpoint and another agent without clearly disclosing that the content exits the local environment. In an agent setting, that can cause accidental exfiltration of prompts, internal notes, secrets, or proprietary data if the model is induced to send content it should have kept local.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.