Crypto Whale Monitor

• Outcome: Pass
• Latest audit: May 28, 2026, 5:53 AM
• Version:
  1.0.3

Overview

This skill appears to do what it says: check public crypto wallet balances through an Ethereum RPC endpoint and print alerts.

Install only if you are comfortable sending the wallet addresses you monitor to the configured Ethereum RPC provider. If RPC_URL includes an API key, treat it as sensitive and use a limited-purpose provider key where possible. Only create a cron job if you intentionally want ongoing background monitoring.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The code hard-codes `toLocaleString('en-US', ...)`, which imposes a specific locale on all users. The policy for this audit flags language/locale constraints unless the user is given a choice or the constraint is clearly justified as region-specific.

VirusTotal

66/66 vendors flagged this skill as clean.