ClawHub
Back to skill

Security audit

[Outdated] CoinMarketCap Onchain Data

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only CoinMarketCap DEX API reference whose external API calls and credential use match its stated purpose.

Installers should treat this as a CoinMarketCap API reference. When using its examples, provide the API key securely, avoid exposing it in shell history or shared logs, and be aware that token addresses, search terms, and request filters are sent to CoinMarketCap.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger guidance is overly broad because it instructs use whenever the user mentions generic DEX/API-related topics, which can cause the skill to activate in situations where the user did not explicitly intend to send data to CoinMarketCap. In this context, the skill is user-invocable and requires an external API key, so over-triggering increases the chance of unnecessary external data transmission and inappropriate reliance on this skill as the 'definitive reference.'

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/discovery.md (reported line 50)May include surrounding context.

bash
# Get top 24h gainers with decent liquidity
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/gainer-loser/list" \
  -H "X-CMC_PRO_API_KEY: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/discovery.md (reported line 182)May include surrounding context.

bash
# Get top meme coins by volume
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/meme/list" \
  -H "X-CMC_PRO_API_KEY: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/discovery.md (reported line 254)May include surrounding context.

bash
# Get tokens launched in last 24 hours with decent liquidity
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/new/list" \
  -H "X-CMC_PRO_API_KEY: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tokens.md (reported line 127)May include surrounding context.

Example

bash
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/token/price/batch" \
  -H "X-CMC_PRO_API_KEY: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tokens.md (reported line 253)May include surrounding context.

Example

bash
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/tokens/batch-query" \
  -H "X-CMC_PRO_API_KEY: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tokens.md (reported line 353)May include surrounding context.

Example

bash
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/tokens/trending/list" \
  -H "X-CMC_PRO_API_KEY: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/use-cases.md (reported line 18)May include surrounding context.

Example:

bash
# Get PEPE price on Ethereum
curl -X GET "https://pro-api.coinmarketcap.com/v1/dex/token/price?network_slug=ethereum&contract_address=0x6982508145454Ce325dDbE47a25d4ec3d2311933" \
  -H "X-CMC_PRO_API_KEY: your-api-key"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill documentation does not warn users that contract addresses, search terms, and the CoinMarketCap API credential will be used with an external service. While the data involved is often not highly sensitive, the absence of disclosure undermines informed consent and can lead to accidental transmission of proprietary investigation targets, internal research terms, or credentials in a broader workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file includes curl examples that send an X-CMC_PRO_API_KEY header to a remote service, which is a privacy- and credential-relevant operation. The surrounding documentation does not include any warning or note about protecting API keys, avoiding shell history exposure, or understanding that the key is transmitted to an external endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file includes example requests that require an X-CMC_PRO_API_KEY header, but it does not include any user warning about protecting API credentials or avoiding accidental exposure in shell history, logs, or shared snippets. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect privacy or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The platform detail examples again show direct use of a sensitive API credential in request headers without any accompanying warning or safe-handling guidance. Repeating credential-use examples without disclosure can encourage insecure copy-paste usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

These example curl commands require transmission of an API key header, but the documentation provides no warning about the privacy and security implications of handling credentials in plaintext command examples. Under SQP-2 for markdown files, this omission merits a finding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file includes multiple curl examples that require placing an API key in the X-CMC_PRO_API_KEY header, but it does not warn users that the key is a credential that should be protected from shell history, screenshots, or shared logs. Under the markdown-file criteria for missing user warnings, credential-related behavior should be disclosed when it may affect privacy or account security.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.