coinank-openapi

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill appears to be a straightforward CoinAnk market-data API helper that uses a declared API key and bounded network access.

Before installing, confirm you are comfortable letting the agent use your CoinAnk API key to make read-only market-data requests to CoinAnk. Use a dedicated key if possible and ensure logs or shared transcripts do not include the API key.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

The agent may send your requested market-data parameters to CoinAnk to retrieve results.

Why it was flagged

The skill instructs the agent to make network requests with curl, but the destination is disclosed and aligned with the CoinAnk API purpose.

Skill content

使用 curl 执行请求... Base URL: 统一使用 `https://open-api.coinank.com`

Recommendation

Use the skill for intended CoinAnk data lookups and review requests that include unusual parameters before allowing them.

Note

ASI03: Identity and Privilege Abuse

What this means

Installing and using the skill gives the agent access to use your CoinAnk API key for CoinAnk API calls, which may affect account quota or subscription access.

Why it was flagged

The skill requires a CoinAnk API key and uses it as an HTTP header for CoinAnk requests; this is disclosed and expected for the service integration.

Skill content

`requires`: { `env`: [`COINANK_API_KEY`] } ... Auth: 从环境变量 `COINANK_API_KEY` 中获取 apikey 注入 Header

Recommendation

Use a dedicated CoinAnk API key with only the needed access level, keep it in the environment variable, and avoid exposing it in chat or logs.