Security audit

Crypto Portfolio Tracker API

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a normal crypto price tracker, but it has under-disclosed credential and supply-chain risks users should review before installing.

Review the package identity before installing, prefer a pinned version or lockfile-managed install, and avoid running unpinned npx commands. Do not set PRISM_API_KEY in an environment where untrusted code can pass a custom baseUrl to PortfolioTracker, because that key may be sent to the configured endpoint.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/index.js:9
Finding: Environment API Key Can Be Exfiltrated Through a Caller-Controlled Base URL
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: skill.json:7
Finding: Conflicting Package and Repository Identities Create Supply-Chain Confusion
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to run the package via npx crypto-portfolio-tracker-api without pinning a specific version. Because npx fetches and executes the latest published package by default, a malicious update, account compromise, or dependency hijack could cause arbitrary code execution on the user's machine when they follow the documentation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This command example also uses unpinned npx, which executes whatever version is current in the registry at runtime. If the package or one of its publish paths is compromised, users invoking the documented command may unknowingly run attacker-controlled code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The track portfolio.json example is another instance of direct execution of an unpinned package from the registry. In the context of a crypto portfolio tool, users may be particularly attractive targets, and arbitrary code execution could expose wallet-related files, API keys, or other sensitive financial data.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill describes code usage and CLI execution that inherently requires network access and may access environment configuration, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization and review gap: consumers cannot easily tell what capabilities the skill expects, and an agent/runtime may grant broader access than intended.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Using npx with an unpinned package name causes the latest published package version to be fetched and executed at runtime, which introduces a supply-chain risk. If the package is compromised, typo-squatted, or updated with malicious code, users invoking the documented command could execute attacker-controlled code on their system.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This second npx example has the same unpinned execution risk: it may download and run whatever version is current at invocation time. In security-sensitive environments, that creates a straightforward path for supply-chain compromise through malicious upstream publication or account takeover.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/index.js:10