Security audit

跨链代币入门工具

Security checks for vulnerabilities and agentic risk

Overview

This token-query skill mostly matches its stated crypto-data purpose, but it asks for command and file-writing authority with broad, inconsistent instructions that users should review before installing.

Review this skill before installing. It appears intended for crypto token data lookup, not theft or damage, but it grants command execution and write capability while giving broad activation language and unclear output/export behavior. Use it only if you are comfortable with a local agent running Python commands, installing packages, using blockchain API keys from environment variables, and potentially writing cache or export files.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented as a read-oriented token query tool, but the documented execution scope explicitly includes create/query/export operations. This scope mismatch can cause an agent to grant broader execution authority than users expect, increasing the chance of unintended file creation, data export, or workflow side effects when the skill is invoked.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The free-version documentation says certain capabilities are unsupported, yet examples expose additional operations like token listing and contract verification. This inconsistency broadens the apparent attack surface and can mislead an orchestrating agent into invoking functions that were not clearly declared or reviewed.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The invocation guidance is overly broad, including generic data analysis, reporting, statistics, and visualization use cases that extend far beyond a narrow token-query skill. Overbroad routing criteria can cause accidental invocation in unrelated contexts, especially because the skill has exec and write permissions.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The capability coverage keywords include very generic trigger phrases such as 'Use', 'when', and broad analytics terminology. In agent environments that rely on semantic matching, this can lead to unintended activation of an exec-capable skill for unrelated tasks, creating an unnecessary execution and data-handling risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill declares exec and write capabilities but the markdown description frames it like a benign data-query tool without prominently warning about command execution or potential side effects. This is dangerous because users or routing systems may treat the skill as read-only and invoke it in higher-trust contexts, despite it being able to run commands and modify data.

Static analysis

No suspicious patterns detected.