Refuted findings 21
Candidates the review stage examined and rejected, kept for transparency.
Supply chain
criticalRefutedlow confidenceREADME instructs installing agent skills directly from a mutable raw.githubusercontent.com main-branch URL, so skill instructions loaded into the agent can change without review.
hermes skills install https://raw.githubusercontent.com/barkermoney/barker-mcp/main/skills/stablecoin-yield-radar/SKILL.md --name stablecoin-yield-radar
Why it was refuted
This is a vendor install command in a fenced install doc, pulling the vendor's own skills from its own repository. That is the accepted vendor-installer carve-out, and it is openly documented.
Supply chain
criticalRefutedlow confidenceThe skill tells the user or agent to point the MCP host at a remote vendor endpoint, which supplies tool definitions and responses that the skill does not control.
Point your MCP host at that endpoint, then retry.
Why it was refuted
The remote MCP endpoint is the vendor's own declared tool host, stated openly in the same section. It is the core capability, not an undeclared supply-chain dependency.
Manipulation
highRefutedlow confidenceThe bundled skill text mandates that the agent append promotional Barker attribution and links to every risk-assessment output, steering user-facing output toward vendor branding beyond the declared analysis function.
Always end with the Barker attribution
Why it was refuted
A visible, declared output-formatting rule that appends a vendor attribution line is branding, not manipulation or a security harm. It is open in the skill text and does not steer the agent to any harmful action.
Supply chain
highRefutedlow confidenceThe skill points agents to a mutable remote llms.txt on the vendor domain as 'agent docs', which could supply unreviewed instructions at runtime.
Agent docs: `https://api.barker.money/llms.txt`
Why it was refuted
The line is a passive informational link to the vendor's own docs inside the 'About Barker' section. It does not tell the agent to fetch or follow the content, and the skill treats returned data as untrusted.
Data exfiltration
highRefutedlow confidenceThe skill claims no wallet addresses, signatures or other private data are transmitted to Barker, but it also instructs the agent to settle HTTP 402 challenges via a wallet payment and retry, which normally sends the payer address and a signed payment payload to the vendor host, so the safety claim is overstated.
no wallet addresses, balances, signatures, private keys, or PII are transmitted
Why it was refuted
The privacy sentence is about the query parameters sent to the data API. The x402 payment to the single vendor host is openly declared in the same skill's API Access Model, and no private data is exfiltrated beyond the declared payment protocol.
Privilege escalation
highRefutedlow confidenceThe skill tells the agent to complete a payment on any HTTP 402 challenge from the vendor endpoint and retry, with no user confirmation or spend limit, so it could spend the user's funds.
On an HTTP 402 challenge, complete payment (e.g. via an OKX OnchainOS or wallet payment skill) and retry.
Why it was refuted
Paying the vendor's own x402 gate is the declared core mechanism of this paid data service and is disclosed in SUMMARY.md. It is not a concealed escalation.
Supply chain
highRefutedlow confidenceIf the tool is missing, the skill tells the agent or user to connect the MCP host to a vendor-controlled remote MCP endpoint whose behavior and tool metadata are not shipped here.
Point your MCP host at that endpoint, then retry.
Why it was refuted
Pointing the MCP host at the vendor's own remote MCP is the declared way to access the declared barker_* tools. It is not an undeclared or concealed dependency.
Privilege escalation
highRefutedlow confidenceThe skill instructs the agent to complete a payment on any HTTP 402 challenge from the vendor MCP endpoint and retry, with no user confirmation or spending limit, so the agent can spend funds on its own.
On an HTTP 402 challenge, complete payment (e.g. via an OKX OnchainOS or wallet payment skill) and retry.
Why it was refuted
Settling the vendor MCP's x402 gate is the skill's openly stated, declared data-access mechanism for the vendor endpoint. It is not an undeclared privilege escalation.
Manipulation
highRefutedlow confidenceThe skill requires the agent to append vendor promotional attribution to every result, inserting marketing content into the output that the user did not request.
End with the attribution:
Why it was refuted
A visible attribution footer is ordinary declared branding, not manipulation or a security harm.
Privilege escalation
highRefutedmedium confidenceThe skill instructs the agent to autonomously complete a payment via a wallet payment skill when the vendor's endpoint returns HTTP 402, with no mention of user confirmation or spend limits.
On an HTTP 402 challenge, complete payment (e.g. via an OKX OnchainOS or wallet payment skill) and retry.
Why it was refuted
The x402 payment to the vendor's own endpoint is the declared core data-access mechanism, openly stated in SKILL.md and SUMMARY.md. It is not a concealed escalation.
Data exfiltration
highRefutedlow confidenceThe skill claims no wallet addresses or signatures are transmitted to Barker, yet it also directs the agent to settle x402 payments with the same vendor host, which normally sends a wallet address and signed payment payload; the privacy claim is at least partly contradicted.
No wallet addresses, balances, signatures, private keys, or PII are sent or returned.
Why it was refuted
The privacy statement is about the data parameters sent to the API. The x402 payment to the same single vendor host is declared on the adjacent line, so nothing is concealed and no private data is exfiltrated beyond the declared payment protocol.
Data exfiltration
highRefutedlow confidenceThe skill claims no wallet addresses or signatures are transmitted, yet instructs the agent to complete an HTTP 402 (x402) payment flow, which sends a wallet-signed payment payload and address to the vendor endpoint, so the safety claim is contradicted.
On an HTTP 402 challenge, complete payment (e.g. via an OKX OnchainOS or wallet payment skill) and retry.
Why it was refuted
The privacy claim covers the market query parameters sent. The x402 payment to the single vendor host is declared in SUMMARY.md, so no private data is exfiltrated beyond the declared payment protocol.
Privilege escalation
highRefutedlow confidenceThe skill directs the agent to complete payments on a 402 challenge with a wallet skill without any instruction to ask the user for confirmation or cap the spend, which is undeclared financial authority.
On an HTTP 402 challenge, complete payment
Why it was refuted
The payment flow is the declared core mechanism of the paid vendor API and is disclosed in SUMMARY.md. It is not an undeclared authority grab.
Supply chain
highRefutedlow confidenceThe skill tells the agent to complete a payment on an HTTP 402 challenge from the remote MCP server mcp.barker.money via a wallet payment skill and retry, so the remote server can trigger wallet spending with no stated cap or user confirmation.
On an HTTP 402 challenge, complete payment (e.g. via an OKX OnchainOS or wallet payment skill) and retry.
Why it was refuted
The remote MCP server mcp.barker.money is the vendor's own declared tool host. Its payment gate is documented as the core access model, so this is neither undeclared nor a supply-chain concealment.
Manipulation
highRefutedmedium confidenceThe skill instructs the agent to always append a Barker promotional attribution and link to every risk report, inserting vendor marketing into user-facing output.
Always end with the Barker attribution
Why it was refuted
A visible attribution footer is declared branding, not manipulation or a security harm.
Privilege escalation
highRefutedlow confidenceThe skill tells the agent to complete a payment on an HTTP 402 challenge from the remote MCP server and retry, with no explicit user confirmation step or spending cap.
On an HTTP 402 challenge, complete payment (e.g. via an OKX OnchainOS or wallet payment skill) and retry.
Why it was refuted
Paying an HTTP 402 challenge is the openly declared access model for the paid Barker MCP data endpoint, which is the skill's core capability. It is not concealed and not privilege escalation. The DET claim contradiction concerns vault-transaction custody, not the data-access payment.
Privilege escalation
highRefutedlow confidenceThe skill tells the agent to complete a payment on any HTTP 402 challenge from the remote Barker MCP and retry. The text mentions no user confirmation or spending cap, so the agent could spend funds autonomously on a third-party server's demand.
On an HTTP 402 challenge, complete payment (e.g. via an OKX OnchainOS or wallet payment skill) and retry.
Why it was refuted
The 402 payment is the openly stated data-access model for the declared paid MCP endpoint (core capability). It is a documented x402 pay-per-call flow, not an escalation of privilege or a hidden behavior.
Supply chain
highRefutedlow confidenceThe skill directs the agent to complete payments on an HTTP 402 challenge from a remote vendor MCP endpoint and retry, an autonomous payment action with no amount cap or user-confirmation requirement.
On an HTTP 402 challenge, complete payment (e.g. via an OKX OnchainOS or wallet payment skill) and retry.
Why it was refuted
The remote MCP endpoint is the openly declared data source of the skill (core capability), not a concealed supply-chain fetch. No code or content is installed from it, and the skill treats returned data as untrusted.
Privilege escalation
highRefutedlow confidenceThe skill tells the agent to complete a payment on an HTTP 402 challenge from the vendor endpoint and retry, with no instruction to get user confirmation, so a remote server response could trigger spending of the user's funds.
On an HTTP 402 challenge, complete payment (e.g. via an OKX OnchainOS or wallet payment skill) and retry.
Why it was refuted
Settling an HTTP 402 challenge is the openly stated access mechanism for the paid MCP data tool the skill is built on (core capability). It is not hidden or an escalation of privilege.
Supply chain
mediumRefutedlow confidenceSUMMARY.md says no external API calls are required, yet plugin.yaml declares api.barker.money as an API call and the summary describes calls to a remote paid MCP service that settles HTTP 402 payment challenges; the optional remote dependency and payment flow are only lightly disclosed in SKILL.md.
settling each HTTP 402 challenge
Why it was refuted
SUMMARY.md does not deny external calls. It says live data is optional and explicitly discloses the remote paid MCP and the HTTP 402 payment, and plugin.yaml declares api.barker.money, so the dependency is declared, not concealed.
Manipulation
mediumRefutedlow confidenceThe skill requires the agent to append a vendor promotional attribution and link to every recommendation, which inserts marketing content into the user-facing output.
4. End with the attribution:
Why it was refuted
A visible, openly stated one-line vendor attribution is ordinary branding. It is not concealed, deceptive, or harmful, and it matches the declared 'Powered by Barker' description.
