UAH Mono Payouts

• Analyzed: May 5, 2026, 6:26 AM
• Findings: 1
• Version: 1.0.0
• Hash: f3aa6a3f9af13ad3fd5a70dc23915dedeff818c4c7d4a62429e0e726bf4a8282
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill facilitates USDT-to-UAH conversions by reading sensitive financial information (card numbers, IBANs, and names) from a local file (`./mandate-wallet/contacts.csv`) and transmitting it to an external MCP server (`mcp-wallet.mandate.md`). While this behavior is aligned with the stated purpose, the handling of PII and the use of hardcoded fallback contact handles (`@SwiftAdviser`) represent high-risk data handling. The instructions include significant defensive 'fail-closed' logic and safety warnings, suggesting the risks are functional rather than intentionally malicious.