GM3 Alertworthy Feed
PassAudited by ClawScan on May 1, 2026.
Overview
This is a simple read-only market-data API skill, with the main thing to notice being that it requires a GM3 API key even though the registry metadata does not declare one.
This skill appears benign and limited to reading a GM3 market-data endpoint. Before installing, make sure you are comfortable giving the agent access to a GM3 Developer API key, store the key securely, and verify that any consuming agent does not treat the feed as automatic trading advice.
Findings (1)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If installed, an agent may need access to a GM3 API key to call the feed. Mishandling that key could expose the user's GM3 entitlement.
The skill requires an API credential for the GM3 service. This is expected for a paid read-only feed, but it is still sensitive account access that should be handled as a secret.
This skill requires a GM3 Developer API key. Requests must include the following header: Authorization: Bearer gm3_key_...
Use a scoped GM3 API key if available, store it only in the platform's secret manager, and avoid sharing outputs or logs that include the Authorization header.