ClawHub
Back to skill

Security audit

Cmc Api Crypto

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only CoinMarketCap API reference skill with expected API-key curl examples and no evidence of hidden execution, persistence, or data exfiltration.

Install if you want CoinMarketCap API reference material available to your agent. Use a real API key carefully: prefer environment variables or a secret store, avoid pasting keys into shared terminals or logs, and review any live curl command before running it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger and description are broad enough to activate on generic crypto/API questions, which can cause the skill to be invoked outside its narrow intended scope. Over-broad routing is risky because it may steer users or agents toward using authenticated tooling and external API guidance when a simpler or safer answer would suffice, increasing the chance of unnecessary network use and credential handling.

Missing User Warnings

Low
Confidence
81% confidence
Finding
The examples instruct authenticated curl usage with an API key header but provide no warning about secret handling, shell history, logging, or accidental disclosure in shared terminals and transcripts. In a skill that explicitly allows Bash, this context makes the issue more concrete because users or agents may copy commands directly into an execution environment where credentials can be exposed.

Static analysis

No suspicious patterns detected.