Crypto Market Data

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:45 PM UTC
• Version:
  1.0.2

Overview

This is a read-only crypto market data skill that uses an AIsa API key to query CoinGecko-style endpoints, with minor documentation clarity issues but no hidden or destructive behavior found.

Install this only if you are comfortable giving it an AIsa API key and sending your crypto market-data queries, including contract addresses or exchange IDs, to AIsa. Use it for crypto pricing and research, not stock, dividend, wallet-balance, transfer, or trading actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 72% confidence
• Finding: The skill requires an AISA_API_KEY and sends user queries to a third-party service, but the descriptive section does not prominently warn users about that data flow. This can cause inadvertent disclosure of sensitive prompts, identifiers, or usage patterns to the external provider, especially in environments where users assume local/read-only processing.

VirusTotal

65/65 vendors flagged this skill as clean.