Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only Cardano DEX helper with a disclosed Blockfrost wallet-balance lookup that users should understand before querying sensitive addresses.
Install only if you are comfortable using third-party Cardano data services. Balance lookups send the wallet address to Blockfrost and can reveal holdings linked to that address; avoid querying addresses you do not want associated with your usage. The skill does not appear to execute trades, modify wallets, install code, or persist data.
The skill directs the agent to send a user-supplied Cardano wallet address to the third-party Blockfrost API without any user-facing privacy notice or consent step. Wallet addresses are pseudonymous but can reveal holdings and transaction-linked financial activity, so silent disclosure to an external service creates a real privacy risk.
The skill explicitly offers wallet balance lookups via Blockfrost, which requires users to provide a wallet address to an external third-party service. While wallet addresses are public on-chain identifiers, users may not understand the privacy implications of linking their address, balances, and request metadata to an external API, so omitting a disclosure is a real privacy weakness.
The documentation instructs users to submit a wallet address to Blockfrost but does not warn that this reveals wallet holdings and linkage metadata to a third-party service. While a Cardano address is public on-chain, sending it to an external API can still create privacy and profiling risk by associating user activity, IP address, and timing with a specific wallet.
The example prompt "Show me all assets held by this wallet" is fairly broad natural language and the file does not define explicit trigger constraints or exclusion conditions. In a manifest-like skill description, this can make it less clear when this specific skill should activate versus other wallet, portfolio, or trading-related skills.
No suspicious patterns detected.
