ClawHub
Back to skill

Security audit

coinank-openapi

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed CoinAnk market-data integration that uses an API key or user-confirmed pay-per-call payments, with no executable code or hidden persistence found.

Install only if you are comfortable sending CoinAnk API requests to CoinAnk and, when using pay-per-call mode, delegating payment signing to the OKX payment skills. Keep COINANK_API_KEY in your environment or secret store, watch for any non-zero payment confirmation before approving it, and avoid broad multi-call analyses unless you understand the potential cost.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The operation requires an `apikey` header parameter but declares `security: []`, which in OpenAPI means no authentication is required for that operation. This mismatch can cause client generators, gateways, or agent tooling to treat the endpoint as unauthenticated, leading to accidental unauthenticated calls, improper secret handling, or policy bypass in systems that rely on the spec for enforcement.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
This endpoint repeats the same contradiction: it marks `apikey` as a required header while explicitly declaring no security requirements. In agent and API-integration contexts, such ambiguity is dangerous because tooling may ignore auth expectations, mishandle credentials, or incorrectly expose the operation as public.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The spec requires callers to place an API key in a custom header for an external service, yet it does not declare a proper security scheme or provide any warning about credential handling, storage, or transmission boundaries. In an agent/skill context, this increases the chance that users or orchestrators will blindly forward sensitive credentials to a third-party endpoint, misuse logs/debug tooling, or mishandle secrets because the trust boundary is not made explicit.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.