Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
- Without declared permissions the skill's intent is opaque and cannot be validated.
Security audit
Sentinel Transaction Safety
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed remote transaction-safety service, but users should treat it as a paid third-party oracle rather than a local security audit.
Install only if you are comfortable sending unsigned transaction payloads and wallet addresses to sentinel-agent.dev and paying per check. Use wallet spending limits and do not treat the returned verdict as a guarantee, especially for sensitive calldata or high-value transactions.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
fastapi>=0.115.0 uvicorn>=0.30.0 httpx>=0.27.0 pydantic>=2.0.0
- Confidence
- 50% confidence
- Finding
- fastapi>=0.115.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
fastapi>=0.115.0 uvicorn>=0.30.0 httpx>=0.27.0 pydantic>=2.0.0
- Confidence
- 50% confidence
- Finding
- uvicorn>=0.30.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
fastapi>=0.115.0 uvicorn>=0.30.0 httpx>=0.27.0 pydantic>=2.0.0
- Confidence
- 50% confidence
- Finding
- httpx>=0.27.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
fastapi>=0.115.0 uvicorn>=0.30.0 httpx>=0.27.0 pydantic>=2.0.0
- Confidence
- 50% confidence
- Finding
- pydantic>=2.0.0
Known Vulnerable Dependency: pydantic==2.0.0 — 2 advisory(ies): CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2024-3772 (Pydantic regular expression denial of service)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
- pydantic==2.0.0
Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
- uvicorn
VirusTotal
62/62 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.