Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward BlockBeats market-data helper that makes disclosed API calls, with minor caution about broad trigger phrases and sending searches to BlockBeats.
Install only if you are comfortable providing a BlockBeats API key and having market/news queries, including keyword search terms, sent to BlockBeats. Treat generated buy/sell interpretations as informational market commentary, not financial advice, and prefer explicit prompts such as 'search BlockBeats for...' to avoid accidental use.
The trigger phrases for Scenario 1 are broad enough that ordinary conversation like 'how's the market today' or 'daily summary' could invoke the skill unexpectedly. In an agent environment, this can cause unintended external API calls and disclosure of user intent or context to a third-party service, especially when multiple requests are fired in parallel.
Multiple request examples force lang=en, which indicates the skill is designed to operate in English regardless of user preference. Because the file does not offer opt-in language selection or explain why English is mandatory, this is a natural-language locale policy concern.
The keyword search triggers are especially ambiguous because patterns like '[keyword] news' or 'what's happening with [keyword]' are common in normal chat and can match many topics unrelated to this skill. This increases the chance of overbroad interception and unintended transmission of arbitrary user-supplied terms to the BlockBeats API.
No suspicious patterns detected.
