Zerion API

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent for querying Zerion through a remote MCP server, but users should notice that it requires a Zerion API key and sends wallet-analysis requests to Zerion.

This appears safe to install as an instruction-only, read-only Zerion API skill. Before using it, configure a dedicated Zerion API key securely and remember that wallet addresses and analysis questions will be sent to Zerion's remote MCP service.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The agent can use the configured Zerion API key to access Zerion API functionality under that key's permissions and account limits.

Why it was flagged

The skill requires a Zerion API key. This is expected for the stated integration, but users should treat the key as an account credential.

Skill content

**Note**: API key required for authentication - get yours at https://developers.zerion.io

Recommendation

Use a dedicated Zerion API key, store it only in the MCP configuration, avoid pasting it into chats, and rotate it if it is exposed.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Queries about wallets, customers, competitors, or tokens may be visible to the remote API provider as part of normal use.

Why it was flagged

The skill relies on a remote MCP server, so wallet addresses and analysis requests are sent to Zerion rather than handled entirely locally.

Skill content

**URL**: `https://developers.zerion.io/mcp`
**Type**: Remote HTTP MCP server
**Auth**: API key required

Recommendation

Only submit wallet addresses and analysis prompts you are comfortable sending to Zerion, and review Zerion's API terms and privacy practices if the queries are sensitive.