Security audit
UAH Mono Payouts
Security checks across malware telemetry and agentic risk
Overview
This financial payout skill is mostly coherent, but it should be reviewed because it can create crypto-to-bank exchange orders and may use hardcoded third-party contact details when recipient contact fields are missing.
Install only if you trust the MCP service and exchanger workflow. Before sending funds, verify the recipient bank details, approval URL, amount, BEP20 network, memo/comment, expiry time, and support path. Do not allow the built-in @SwiftAdviser or swiftadviser@gmail.com fallback unless that contact is intentionally part of your payout flow.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
63/63 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.