Trustra Escrow

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:38 AM UTC
• Version: 1.0.0

Overview

This appears to be a real escrow/payment skill, but it can move funds and expose wallet secrets with limited built-in safeguards.

Install only if you trust Trustra's API, managed-wallet model, and dispute process. Keep minimal funds in the wallet, protect credentials.json and TRUSTRA_API_KEY, avoid running export_key.py in logged or autonomous workflows, and require explicit human review before any command that pays, releases, withdraws, cancels, disputes, or exports keys.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation indicates capabilities to read/write local files, use environment data, and communicate with a remote API, yet no permissions are declared. This creates a transparency and consent gap: an agent or user may invoke wallet registration, credential storage, or networked payment actions without an explicit permissions model governing those sensitive operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is escrow transactions, but the documented behavior also includes wallet provisioning, local credential storage, balance retrieval, and private key export. That mismatch is dangerous because users may trust the skill as a narrow escrow tool while it actually manages long-lived secrets and wallet lifecycle operations with materially higher risk.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This script explicitly exports a managed wallet's private key and prints it to stdout, which materially exceeds the stated escrow-focused purpose of the skill. In an agent setting, key export defeats custody boundaries: secrets can be exposed to logs, calling processes, terminal history, or downstream tools, enabling full wallet compromise.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs users to create, fund, and confirm escrow transactions without prominent warnings that these actions can move real on-chain funds and may be irreversible once confirmed. In a payments skill, omission of that warning materially increases the chance of accidental loss, mistaken release of funds, or unsafe autonomous execution by an agent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill exposes key-management functionality through `export_key.py` and stores credentials in `credentials.json`, but it provides only minimal guidance and no strong warning about secret exfiltration, wallet takeover, or irreversible asset theft if those materials are leaked. In the context of crypto payments, exported private keys and API keys are highly sensitive and directly monetizable.

External Transmission

Medium

• Category: Data Exfiltration

Content

url = f"{BASE_URL}/wallet/export"
    headers = get_headers(api_key)
    
    response = requests.post(url, json={}, headers=headers)
    
    if response.status_code == 200:
        return response.json()

• Confidence: 89% confidence
• Finding: requests.post(url, json=

Credential Access

High

• Category: Privilege Escalation

Content

def save_credentials(creds: dict) -> bool:
    """Save credentials to credentials.json file."""
    try:
        with open(CREDS_FILE, "w") as f:
            json.dump(creds, f, indent=2)

• Confidence: 83% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

print(f"Agent ID: {agent.get('id')}")
        print(f"Wallet: {agent.get('walletAddress')}")
        print("")
        print("API Key saved to credentials.json")
        print("")
        print("IMPORTANT: Back up your API key. It will not be shown again.")
        print(f"API Key: {result.get('apiKey')}")

• Confidence: 95% confidence
• Finding: credentials.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0

• Confidence: 97% confidence
• Finding: requests>=2.28.0

Known Vulnerable Dependency: requests==2.28.0 — 7 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +4 more

High

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: requests==2.28.0

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.