Btc Contract Scanner Pro

• Outcome: Pass
• Latest audit: Jun 8, 2026 at 3:58 AM UTC
• Version:
  1.0.0

Overview

This is a disclosed paid crypto-trading signal skill with Telegram alerts, and the artifact does not contain executable code, credential access, persistence, or hidden behavior.

Before installing, treat this as a paid crypto signal service: verify the publisher and payment destination independently, understand that Telegram interactions may expose your username/chat activity to Telegram and the bot operator, and do not rely on the backtest or signals as financial advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly advertises Telegram real-time push notifications, which implies trade signals, alerts, or potentially user-linked activity may be sent to a third-party platform. In a paid trading skill, this creates a real privacy and data-sharing risk if users are not clearly warned what data is transmitted, retained, or exposed to Telegram or the bot operator.

VirusTotal

64/64 vendors flagged this skill as clean.