Security audit

Kraken

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Kraken account-query skill that handles sensitive financial data but does not show hidden, destructive, trading, or withdrawal behavior.

Install only if you are comfortable letting the skill query confidential Kraken account information. Create a Kraken API key limited to query/balance/ledger/earn permissions, avoid trading or withdrawal permissions, keep KRAKEN_API_KEY and KRAKEN_API_SECRET out of chat and source control, protect any .env file, and run raw account-history or deposit-address commands only when you intentionally want that data displayed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The module header presents the tool as a high-level portfolio wrapper, but the implementation also exposes unrestricted raw passthrough into kraken_api.py. That mismatch can mislead users and reviewers into granting trust to a broader capability set than the documentation suggests, increasing the chance that sensitive or state-changing API actions are invoked unexpectedly.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The CLI exposes a generic subprocess-based passthrough that forwards arbitrary commands to kraken_api.py with the same loaded environment and credentials. In a skill context, this broadens the effective attack surface from curated read-oriented commands to whatever capabilities the downstream script supports, potentially including trades, withdrawals, or data exfiltration.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The example trigger phrases are very broad natural-language requests such as 'What is my crypto portfolio?', 'What is my net worth?', and 'Show my trade history'. In an agent ecosystem, broad triggers can cause this skill to activate during ordinary conversation and then access sensitive financial account data, including balances, trading history, and deposit addresses, without the user explicitly choosing this specific skill.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The file enables arbitrary raw command execution through kraken_api.py without a clear warning at the point of use. In an agent skill, that is dangerous because callers may believe they are invoking only portfolio-reporting behavior while actually accessing a much broader command surface under account credentials.

Unpinned Dependencies

Low

Category: Supply Chain
Content: python-kraken-sdk>=1.2.0 python-dotenv>=1.0.0
Confidence: 90% confidence
Finding: python-kraken-sdk>=1.2.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: python-kraken-sdk>=1.2.0 python-dotenv>=1.0.0
Confidence: 96% confidence
Finding: python-dotenv>=1.0.0

Known Vulnerable Dependency: python-dotenv==1.0.0 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: python-dotenv==1.0.0

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.