Zerion API

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill appears to do what it says—connect to Zerion's remote MCP API for read-only crypto wallet research—but users should note the API key and third-party data flow.

This looks benign for its stated purpose. Before installing, verify the Zerion MCP endpoint and publisher, configure a dedicated API key if possible, and remember that wallet addresses and analysis requests will be sent to Zerion's remote service.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Your Zerion API key will be used when the agent calls the Zerion MCP server.

Why it was flagged

The skill requires a Zerion API key in MCP configuration. This is expected for the stated Zerion API integration, but it grants the MCP connection access under the user's Zerion account or quota.

Skill content

**Auth**: API key required ... "Authorization": "Bearer YOUR_API_KEY"

Recommendation

Use a dedicated, revocable API key if possible, monitor usage, and avoid sharing the key in chat transcripts or prompts.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Wallet addresses or research queries you ask about may be visible to the Zerion service.

Why it was flagged

The skill routes MCP requests to a remote third-party service. This is disclosed and purpose-aligned, but wallet addresses, query context, and authentication headers may be sent to Zerion.

Skill content

**URL**: `https://developers.zerion.io/mcp`
**Type**: Remote HTTP MCP server

Recommendation

Only query wallet addresses and business research you are comfortable sending to Zerion, and verify the MCP URL before configuring it.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

It may be harder to independently confirm who published the skill from registry metadata alone.

Why it was flagged

The registry metadata does not provide a source repository or homepage. Because the artifact set is instruction-only and contains no executable code, this is a provenance note rather than evidence of malicious behavior.

Skill content

Source: unknown
Homepage: none

Recommendation

Verify the publisher and official Zerion documentation before installing or adding an API key.