VIGIL Security Scanner

• Outcome: Review
• Latest audit: Jun 8, 2026 · 5:46 PM UTC
• Version: 1.0.3

Overview

This appears to be a real crypto security scanner, but it bundles wallet-changing and reputation-reporting actions despite repeatedly framing the skill as read-only.

Install only if you are comfortable sending wallet and token addresses to the VIGIL hosted service. Do not run the revoke, batch-revoke, or report-scam scripts unless you intentionally want to sign an onchain transaction or submit an external report. Keep Bankr read-write authentication disabled unless you specifically need revocation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill executes shell commands (`bash`, `curl`, `jq`, `grep`, `tr`) but does not declare shell permissions. That creates a capability-transparency problem: reviewers or runtime policy may treat it as less privileged than it really is, increasing the chance that networked shell execution is approved without proper scrutiny.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The reference documents a `POST /report/submit` capability to send scam reports, which exceeds the stated manifest scope of scanning and revocation. Scope drift in security tooling is dangerous because an agent may invoke undocumented or under-reviewed write actions, causing unexpected external submissions and user-data transmission.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This script performs a state-changing report submission even though the skill is described as a keyless read-only scanner. That mismatch is dangerous because users or downstream agents may invoke the skill under the assumption that it only analyzes data, when it can actually submit external reports and alter community reputation data.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The header comments explicitly advertise scam-report submission behavior, which contradicts the stated read-only scanner purpose of the skill. In an agent setting, this kind of capability mismatch increases the chance of unsafe tool use, accidental reputation-impacting actions, and social engineering through misleading packaging.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation includes revocation build/submit endpoints that result in blockchain transactions but does not place an explicit warning near them about signing, gas costs, irreversible onchain effects, and the need for user confirmation. In an agent context, weak warning language increases the risk that a tool is wired into flows that initiate destructive wallet actions without sufficiently informed consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 2. Scan approvals (wallet)

```bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

• Confidence: 94% confidence
• Finding: This step transmits a user-supplied wallet address to an external service (`mcp.vigil.codes`). Even though the input is strongly validated and limited to a hex address, wallet addresses are still sensitive metadata in many contexts, and sending them to a third party can leak a user's holdings, behavior, or investigation targets.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 3. Scan token safety

```bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

• Confidence: 94% confidence
• Finding: This call sends the target contract address to an external API for token safety analysis. While the input validation meaningfully reduces injection risk, the transmission still exposes the user's token of interest or investigation target to a remote service outside the local trust boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 4. Check honeypot

```bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

• Confidence: 94% confidence
• Finding: The honeypot check posts the token address to an external service. In context this is expected functionality rather than covert exfiltration, but it still creates privacy and dependency risk because a third party learns what asset the user is evaluating.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 5. Get safety score

```bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

• Confidence: 94% confidence
• Finding: This step transmits the contract address externally to obtain a safety score. The skill context makes the behavior expected for a scanner, but it remains a real data-transfer issue because third-party services can log, correlate, or profile scanned addresses.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 6. Generate wallet report

```bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

• Confidence: 95% confidence
• Finding: The wallet report call is more sensitive than a simple token lookup because it explicitly sends a wallet address for full security-posture analysis. That can reveal which wallet a user controls or is investigating, and a remote operator could correlate these requests over time.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 7. Monitor wallet (real-time alerts)

```bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

• Confidence: 95% confidence
• Finding: The monitoring call sends a wallet address and monitoring parameters to an external service. In context this is functionally necessary for hosted monitoring, but it increases privacy risk because it can enable ongoing profiling of a wallet of interest rather than a one-off lookup.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 8. Token market context (price + liquidity)

```bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

• Confidence: 93% confidence
• Finding: This market-context lookup sends the token address to an external service. The data is public onchain, but the user's interest in a particular token may still be sensitive and subject to logging or analytics by the service provider.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 9. Deployer reputation (verification + age)

```bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

• Confidence: 93% confidence
• Finding: The deployer reputation request transmits the contract address to an external backend. This is consistent with the skill's purpose, but it still moves user query data outside the system boundary and introduces third-party trust and availability risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 10. Batch scan multiple tokens

```bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

• Confidence: 94% confidence
• Finding: The batch scan posts a token list to the remote API; even with a single token here, the pattern scales to bulk disclosure of a user's watchlist or portfolio interests. That can be valuable metadata for profiling or surveillance by the receiving service.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 11. Multi-source consensus verdict

```bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

• Confidence: 93% confidence
• Finding: The consensus verdict call sends the token address to a hosted service that aggregates multiple signals. Although this is aligned with the advertised scanner functionality, it still constitutes external transmission of user interest data and reliance on a third-party analysis service.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: SKILL.md:47