Security audit

Cmc Api Dex

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only CoinMarketCap DEX API reference with ordinary curl examples, and no evidence of hidden execution, persistence, or data exfiltration.

Install only if you want CoinMarketCap DEX API reference help. Use a CoinMarketCap key you are comfortable using for these queries, prefer environment variables or a secret manager for real keys, and be aware that queried token addresses may reveal research or trading interests to CoinMarketCap.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger guidance is overly broad because it includes generic phrases like requests about DEX API, token contract address lookups, security checks, and building integrations, which can cause the skill to activate in contexts where a narrower or more appropriate skill should be used. Overbroad activation increases the chance of unintended tool use, irrelevant API guidance, and scope hijacking of user requests, especially in systems that auto-select skills from natural-language triggers.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The examples instruct users to send both a token contract address and an API key to CoinMarketCap's external API without explicitly warning that this transmits potentially sensitive usage data to a third party. While contract addresses are often public, in some workflows they may reveal research targets, watchlists, or proprietary trading interest, and the omission can mislead users about privacy and data-sharing implications.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The documentation shows passing an API key directly in a curl header without any accompanying warning about shell history, terminal logging, process inspection, or accidental copy/paste into shared environments. While this is a common documentation pattern, it can normalize insecure credential handling and increase the chance that users expose secrets in local history, screenshots, CI logs, or support transcripts.

Static analysis

No suspicious patterns detected.