Tokenbroker

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:33 AM UTC
• Version: 1.0.2

Overview

This skill appears to do what it advertises, but it handles crypto launches, private keys, repository data, external uploads, and promotional token content with scoping and consent gaps that need review.

Install only if you intend to use an agent for crypto token launch work. Review the .env handling, use testnet first, avoid storing high-value private keys, confirm every external upload and on-chain action, and manually review any generated promotional copy for compliance, accuracy, and risk disclosure before publishing or launching.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill explicitly documents outbound connectivity to GitHub, nad.fun, and Monad RPC, yet there is no declared permissions model or activation guard describing when network access is allowed. In an agent environment, undocumented network capability increases the chance of silent external calls, data exfiltration, or unintended token-launch side effects if the skill is invoked automatically.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases "scan this project" and "analyze this codebase" are broad, natural-language requests that can easily match ordinary user prompts outside a narrowly intended workflow. This can cause the skill to activate unexpectedly, giving it access to local repository contents and influencing downstream token-generation and launch behavior based on whatever directory the agent treats as the target project.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill is framed as a broad 'complete memecoin launch solution' that analyzes repositories, generates assets, and launches tokens, without narrow invocation criteria or user-consent checkpoints. In agentic systems, overly broad task wording can cause unintended activation for loosely related prompts, leading to risky financial, reputational, or network actions.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: Although the text claims testnet is the default, the examples and configuration prominently use 'mainnet', which can normalize production deployment without clear opt-in. In a token-launch skill, that mismatch raises the chance of accidental real-network actions with financial consequences.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The generator emits polished token marketing copy for DeFi, staking, yield, governance, and meme-token scenarios without any balancing risk disclosure, suitability caveat, or indication that the text is synthetic promotional content. In this skill’s context, the output is directly tied to token launch activity on nad.fun, so the omission can materially increase the chance of users being nudged toward speculative financial behavior using one-sided, compliance-insensitive messaging.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The meme-token description includes phrases such as 'moon-sized gains,' 'moonshots,' and 'financial freedom,' which imply investment upside and can be interpreted as inducements or performance-oriented promotion. Because this skill is designed to analyze projects and generate token identity/promo for launch, such language is more dangerous than generic copywriting: it can be operationalized immediately into live token promotion without user opt-in, qualification, or compliance review.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The upload functions send user- or repo-derived token image and metadata to external nad.fun endpoints, but the functions themselves provide no disclosure, consent gate, or indication that data leaves the local environment. In an agent skill context, this can cause unintended exfiltration of generated content or project-derived branding/metadata to a third-party service, especially when invoked automatically as part of a workflow.

Credential Access

High

• Category: Privilege Escalation

Content

- No credentials are transmitted to external servers beyond their intended endpoints (GitHub API, nad.fun API, Monad RPC)
- The skill operates entirely within your local environment

### .env File Generation
- The Install Wizard generates a `.env` file on your local machine
- This file is **never committed** to version control (gitignored)
- You can review and edit it at any time

• Confidence: 88% confidence
• Finding: .env

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.