Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent CoinMarketCap API reference skill with only minor documentation-safety notes about API key handling.
Before installing, treat this as CoinMarketCap-specific API documentation. Use environment variables or a secret manager for your CMC API key, avoid pasting real keys into shared terminals or checked-in scripts, and confirm the skill is only used when you actually want CoinMarketCap endpoint guidance.
The manifest says to use the skill whenever the user asks how to get crypto data programmatically or needs REST endpoint documentation, and calls it the go-to reference for any CMC cryptocurrency API question. Those activation conditions are broad and lack exclusions or scope boundaries, which increases the chance of unintended invocation for general crypto API discussions.
This markdown file includes curl examples that require an X-CMC_PRO_API_KEY header, but the surrounding documentation does not warn users to protect the key, avoid committing it, or avoid exposing it in shared shells/history. Because SQP-2 applies to markdown files when behaviors could affect privacy or system integrity, the omission of a credential-handling warning is a minor but valid disclosure gap.
This markdown file includes example curl commands that require an X-CMC_PRO_API_KEY header, but it does not warn users to avoid exposing real API keys in shell history, shared terminals, or checked-in scripts. Because markdown files should disclose behaviors affecting privacy or sensitive data handling, the omission is a mild safety concern.
The historical listings example again shows direct use of an API key in a request header, but the surrounding documentation provides no warning about protecting credentials. This is relevant user-facing guidance for markdown documentation that demonstrates operations involving sensitive secrets.
This example demonstrates authenticated API usage and therefore involves a sensitive credential, yet the document offers no warning about safe storage or handling of the API key. The omission could lead users to copy unsafe practices from the sample.
This markdown file includes repeated curl examples that send the X-CMC_PRO_API_KEY header over network requests, but the guide does not warn users that they are providing a credential and should avoid exposing it in shell history, screenshots, or shared logs. Because SQP-2 applies to markdown files when behaviors could affect privacy or system integrity, the omission is a valid documentation warning gap.
No suspicious patterns detected.
