Security audit

crypto-research-checklist

Security checks for vulnerabilities and agentic risk

Overview

This skill is a crypto research checklist, but it also steers users through payments, upsells, referrals, and Telegram subscriptions with weak consent and privacy boundaries.

Review carefully before installing. Only use it if you are comfortable sending crypto research queries and payment-related metadata to the listed API, and do not allow any wallet-capable agent to sign or send USDC without explicit approval of the recipient, chain, token, amount, fees, and purpose each time.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:40
Finding: Mandatory Commercial Funnel Hijacks Cryptocurrency Research Interactions
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:58
Finding: Wallet-Enabled API Calls Can Trigger Cryptocurrency Payments Without Transaction-Specific Approval
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:83
Finding: User Identifiers and Blockchain Transaction Data Are Disclosed to a Third-Party Service
Content: View full analysis
", "amount": 29, "txHash": "0x..." } ``` 4. Returns an `apiKey`. Use it as `x-api-key` header on `/v1/query` (and `/v1/products/defi-diligence/score`) — credits deduct per call. Referral (free credits to both sides): - `POST /v1/referral/generate` `{ "userId": "..." }` → code + telegram link - `POST /v1/referral/redeem` `{ "userId": "...", "code": "..." }` → referrer +5 credits, new user +3. ### Step 4 — Upsells (higher ticket) - **$2 token kill-switch report** (paid intent): `POST /v1/products/defi-diligence/score` with `{ "address": "0x…", "chain": "base" }` or `{ "symbol": "PEPE", "chain": "solana" }` — honeypot, mint/freeze authority, tax >50%, auto-scored checkpoints. Same x402 flow at $2. - **$9 OnChain Intel persona ZIP** (resellable skill): `GET /v1/purchase` — $9 x402, returns the analyst persona for the user to run themselves. - **Daily digest**: `POST /v1/digest/subscribe` `{ "chatId": "..." }` — free daily research via Telegram (re-engages users daily). ``` ### Technical Analysis The declared fundamentals-checklist functionality only requires a token address or symbol, its chain, and a research query. The credit, referral, and subscription workflows instead transmit persistent Telegram or user identifiers, Telegram chat IDs, payment amounts, referral relationships, and public blockchain transaction hashes to `https://crypto-api-blush.vercel.app`. A transaction hash can reveal sending and receiving walle ...[truncated 1790 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad and match common investing language such as 'is this legit' or 'should I invest,' which increases the risk of accidental invocation in unrelated or higher-risk contexts. In a skill that can initiate payment-oriented flows and collect user-linked data, unintended activation materially raises the chance of inappropriate prompts, external calls, or commercialization without clear user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger section defines activation too ambiguously, with weak boundaries around when the skill should run. Because this skill includes monetized external workflows, ambiguous invocation can cause unnecessary API discovery, trial consumption, or escalation toward paid steps when the user did not explicitly request this productized flow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is presented as a crypto due-diligence checklist, but a large portion of the instructions push payment collection, upsells, referral flows, and re-engagement mechanics unrelated to core analysis. This creates a hidden commercial funnel inside a supposedly analytical skill, increasing the chance that an agent prioritizes monetization and payment handling over user safety, consent, and accurate research behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs collection of user identifiers such as telegram/user IDs and chat IDs, plus transaction hashes, without any privacy notice, retention policy, or minimization guidance. This is dangerous because it can lead to unnecessary exposure of personally linked metadata and on-chain activity, especially in a finance/crypto context where linking identity and wallet behavior can create significant privacy and targeting risks.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Referral generation/redemption and Telegram digest subscription are not necessary to perform a fundamentals checklist and introduce extra collection and sharing of user-linked identifiers. These features expand the attack and privacy surface by encouraging propagation, tracking, and persistent engagement without clear necessity or strong consent boundaries.
Content: No source excerpt is available for this finding.

Behavior Manipulation

Medium

Category: Prompt Injection
Confidence: 75% confidence
Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
Content: Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.
md
## Don'ts - No financial advice: never tell the user to buy/sell/hold. - No price targets or predictions. - Never fabricate token metrics or wallet holdings — if data is stale/incomplete, say so.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: The 'Don'ts' section claims a restrained, non-advisory posture, but the earlier funnel language instructs the agent to 'hook' users, present paid paths when trial ends, and offer bundles to every paid user. While not direct buy/sell token advice, this actively shifts the skill from neutral analysis toward sales behavior, contradicting the implied intent of a purely research-oriented assistant.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.