ClawHub
Back to skill

Security audit

CoinMarketCap Onchain Data APIs

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-style CoinMarketCap DEX API reference with expected external API examples and no hidden execution, persistence, or destructive behavior.

Before installing, understand that this skill is meant to help with CoinMarketCap DEX API calls. Do not paste real API keys into shared logs or committed files; prefer environment variables or a secrets manager. Treat wallet-address and transaction results as potentially sensitive when they relate to a person or organization.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill advertises broad trigger phrases such as general DEX API, token lookup, security API, liquidity pool API, and building DEX integrations, which can cause the skill to activate for routine user requests beyond narrowly scoped CoinMarketCap reference needs. Overbroad activation increases the chance of inappropriate tool use or irrelevant context injection, though this file is documentation-focused and does not contain direct exploit logic.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/discovery.md (reported line 50)May include surrounding context.

bash
# Get top 24h gainers with decent liquidity
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/gainer-loser/list" \
  -H "X-CMC_PRO_API_KEY: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/discovery.md (reported line 182)May include surrounding context.

bash
# Get top meme coins by volume
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/meme/list" \
  -H "X-CMC_PRO_API_KEY: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/discovery.md (reported line 254)May include surrounding context.

bash
# Get tokens launched in last 24 hours with decent liquidity
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/new/list" \
  -H "X-CMC_PRO_API_KEY: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tokens.md (reported line 127)May include surrounding context.

Example

bash
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/token/price/batch" \
  -H "X-CMC_PRO_API_KEY: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tokens.md (reported line 253)May include surrounding context.

Example

bash
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/tokens/batch-query" \
  -H "X-CMC_PRO_API_KEY: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tokens.md (reported line 353)May include surrounding context.

Example

bash
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/tokens/trending/list" \
  -H "X-CMC_PRO_API_KEY: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/use-cases.md (reported line 18)May include surrounding context.

Example:

bash
# Get PEPE price on Ethereum
curl -X GET "https://pro-api.coinmarketcap.com/v1/dex/token/price?network_slug=ethereum&contract_address=0x6982508145454Ce325dDbE47a25d4ec3d2311933" \
  -H "X-CMC_PRO_API_KEY: your-api-key"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file includes curl examples that require an X-CMC_PRO_API_KEY header, but the surrounding documentation does not warn users that they are supplying a credential or advise secure handling. Under the markdown-file warning criterion, credential-related behavior should be disclosed when it may affect user privacy or system security.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file includes executable curl examples that send an API credential via the X-CMC_PRO_API_KEY header. While the examples are routine, the document does not include any user-facing warning about handling the credential securely, which is relevant for markdown under the missing user warnings category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The Token Transactions section explicitly exposes maker_address and transaction history data, which can affect user privacy expectations. The markdown does not provide any disclosure about the sensitivity of address-level activity data or recommend careful handling of queried results.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file includes repeated curl examples that require placing X-CMC_PRO_API_KEY directly in request headers, which involves handling a credential and transmitting it over the network. The document does not include any warning about protecting API keys, avoiding shell history leakage, or using environment variables instead of inline secrets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.