Security audit
Security checks for vulnerabilities and agentic risk
This skill is a documentation-only CoinMarketCap x402 integration that clearly involves automatic small USDC payments, but users should enable it only with a limited wallet and explicit payment awareness.
Install only if you intend to use CoinMarketCap x402 paid data access. Use a dedicated low-balance Base wallet, keep the private key in environment or wallet tooling rather than prompts or source code, and require explicit confirmation before agents make repeated paid requests.
The trigger list is broad enough to match generic phrases like "no API key" or "USDC payment," which can cause the skill to be invoked outside the user's actual intent. In this skill's context, unintended invocation is more dangerous because the skill is designed to facilitate paid on-chain requests, so accidental use can lead to unexpected wallet interactions or charges.
The introductory description markets the service as instant and keyless but does not prominently warn that use requires a private-key-controlled wallet and automatically signs on-chain USDC payments. In an AI-agent setting, this omission can mislead users into invoking the skill without understanding that requests may spend funds or require sensitive wallet material.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: "2"
## Manual Flow with curl
```bash
# Step 1: Get the 402 response with payment requirements
No suspicious patterns detected.