ClawHub
Back to skill

Security audit

Gecko Terminal API

Security checks across malware telemetry and agentic risk

Overview

This skill is a read-only GeckoTerminal market-data helper that does not access wallets, credentials, files, or trading functions.

Install this if you are comfortable sending requested network, token, pool, and search-query values to GeckoTerminal's public API. It does not need API keys or wallet access, but market data should be treated as informational rather than trading advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.secret_argv_exposure

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/geckoterminal-cli.mjs:8

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
SKILL.md:43