加密组合跟踪

• Outcome: Review
• Latest audit: Aug 10, 2026 · 9:10 AM UTC
• Version: 1.0.0

Overview

This crypto portfolio skill should be reviewed before installation because it combines portfolio tracking with broad command execution, file writes, and automated trading behavior without clear limits or consent controls.

Install only after reviewing the requested exec capability and financial-account behavior. Use read-only exchange/API keys where possible, do not provide wallet keys or trading-enabled credentials unless you explicitly intend to allow trades, and require command previews, file-write confirmation, and per-trade approval before use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The document asserts that risky code was removed and security improved, yet the same skill declares exec capability and additional high-impact behaviors elsewhere. This creates a misleading trust signal that can cause operators and users to lower scrutiny around a skill that still exposes dangerous primitives.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The security section claims command execution is limited to a whitelist, but no such whitelist or enforcement mechanism is defined, while the skill advertises generic exec capability. This mismatch can lead reviewers to assume controls exist when the platform may allow broader system command execution.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: A crypto portfolio tracking skill does not need generic system command execution to fulfill its stated purpose, so exposing exec materially expands the attack surface. In an agent environment, this can be abused for local reconnaissance, file access, command chaining, or facilitating further compromise if user input influences execution.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Documented automatic trade execution exceeds the reasonable scope of a portfolio tracking skill and introduces account-impacting financial actions. In the crypto context, unauthorized or poorly gated trade execution can cause immediate monetary loss, irreversible transactions, and misuse of exchange or wallet credentials.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation text is broad enough to trigger on many general crypto-related requests rather than a narrowly defined portfolio-tracking use case. Overbroad activation increases the chance the agent invokes a skill with risky capabilities, including exec and trade-related features, in contexts where the user did not intend that behavior.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The markdown describes automated trading and similar transaction-impacting functions without prominent user warnings, consent requirements, or account-risk disclosures. In a crypto environment, such omissions are especially dangerous because actions may be financially irreversible and can directly affect exchange or wallet assets.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill claims file write support without warning users that local data may be modified, overwritten, or corrupted. In an agent setting, undocumented write behavior can lead to unintended persistence, damage to project files, or creation of sensitive artifacts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill mentions command execution without a corresponding warning about system-impacting operations such as process execution, environment access, or filesystem interaction. Given the presence of exec in the declared tools, lack of disclosure materially increases the risk of unsafe invocation and underestimation of host impact.

Static analysis

No suspicious patterns detected.