DEX代币分析

• Outcome: Review
• Latest audit: Aug 10, 2026 · 9:28 AM UTC
• Version: 1.0.0

Overview

This skill is a DEX token analysis guide, but it asks for command execution and financial data/API access without clear limits, consent, or privacy boundaries.

Review before installing. Use this only if you are comfortable granting an agent command-execution authority alongside financial API access. Configure only limited-scope API keys, do not provide wallet private keys or sensitive portfolio data unless necessary, and require explicit confirmation before any command, export, monitoring job, scheduled task, or third-party API request.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The document presents the skill as potentially usable in a pure markdown mode while the manifest explicitly includes exec capability and later sections discuss command execution. This mismatch can mislead users or orchestration systems into trusting the skill as non-executing, increasing the chance that system-impacting behavior is invoked without informed consent.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The description claims risky code was removed and security improved, but the skill still advertises execution-oriented behavior elsewhere. Security-assuring language that conflicts with actual capabilities is dangerous because it encourages unwarranted trust and can suppress scrutiny of actions that may access the system or external services.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Including exec for a token-analysis skill without a narrowly defined operational need expands the attack surface unnecessarily. In an agent setting, any command-execution capability can be repurposed for local system actions, data access, or chaining with user-controlled inputs, making an otherwise analytical skill materially more risky.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The documentation presents the skill as a pure SKILL.md/non-code capability while also declaring exec support, API-backed behavior, environment variable setup, and automation workflows elsewhere. This mismatch can mislead users and agents into granting broader trust or execution privileges than they would for a genuinely non-executable skill, increasing the chance of unintended code execution or network/data access.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The skill claims that external dependencies and risky code were removed, yet the rest of the file repeatedly relies on third-party APIs, API keys, network connectivity, and executable tooling. Such contradictory security claims are dangerous because they can create false assurance, causing reviewers or users to underestimate the skill's real attack surface and secrets-handling requirements.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The activation guidance is broad and ambiguous, causing the skill to be invoked for loosely related requests rather than a tightly bounded use case. Overbroad routing increases the chance that sensitive data, external API usage, or exec-capable behavior is triggered in contexts the user did not intend.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill describes use of API keys and external data sources but does not clearly warn users that prompts, addresses, or analysis inputs may be transmitted to third-party services. In a finance and crypto context, this can expose sensitive portfolio, wallet, or operational information and creates privacy and credential-handling risks.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown advertises command execution support without a prominent warning about filesystem, process, or host-level side effects. Because the skill is framed as an analysis tool, users may not expect system-impacting actions, which makes hidden or poorly disclosed execution capability more dangerous in context.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation scope is overly broad and inconsistent, spanning crypto, stocks, exports, monitoring, and automation tasks, which makes it unclear when the skill should activate. In an agent environment, ambiguous triggering can cause the skill to run for unrelated requests and potentially access tools, APIs, or files outside the user's intended scope.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The skill advertises exporting results to local storage without warning about file creation, overwrite behavior, destination paths, or user consent. In agent-driven environments, even benign exports can overwrite existing files or create unexpected artifacts, especially when combined with exec/tool permissions.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.