Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only CoinMarketCap DEX API reference with expected authenticated API examples and no hidden execution, persistence, or unrelated data access.
Install only if you want CoinMarketCap DEX API reference help. Treat your CMC API key as a secret: avoid pasting real keys into chats, logs, screenshots, shared scripts, or shell history, and prefer environment variables or a secret manager when running examples.
The trigger text and description are broad enough that the skill could be invoked for many generic token- or DEX-related requests, increasing the chance of unintended activation. In a security-sensitive/API-reference skill, overbroad routing can expose users to irrelevant tool use, confusion, or accidental handling of sensitive contexts such as contract addresses and API-related workflows.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Get top 24h gainers with decent liquidity
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/gainer-loser/list" \
-H "X-CMC_PRO_API_KEY: your-api-key" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Get top meme coins by volume
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/meme/list" \
-H "X-CMC_PRO_API_KEY: your-api-key" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Get tokens launched in last 24 hours with decent liquidity
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/new/list" \
-H "X-CMC_PRO_API_KEY: your-api-key" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/token/price/batch" \
-H "X-CMC_PRO_API_KEY: your-api-key" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/tokens/batch-query" \
-H "X-CMC_PRO_API_KEY: your-api-key" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://pro-api.coinmarketcap.com/v1/dex/tokens/trending/list" \
-H "X-CMC_PRO_API_KEY: your-api-key" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Example:
# Get PEPE price on Ethereum
curl -X GET "https://pro-api.coinmarketcap.com/v1/dex/token/price?network_slug=ethereum&contract_address=0x6982508145454Ce325dDbE47a25d4ec3d2311933" \
-H "X-CMC_PRO_API_KEY: your-api-key"
The skill instructs users to place an API key in request headers but does not warn against exposing real secrets in prompts, logs, screenshots, or shared shell history. Because this is an API-focused skill with concrete curl examples, users may copy/paste live credentials into unsafe contexts, leading to credential leakage or unauthorized API usage.
This markdown file includes curl examples that send an X-CMC_PRO_API_KEY header, which is a credential-bearing network operation. The surrounding documentation does not warn users to protect the key, avoid committing it to shell history/scripts, or use secure secret handling when running the examples.
This markdown file includes curl examples that require an X-CMC_PRO_API_KEY header, which involves use of credentials. The documentation does not include any warning to keep the key secret or avoid exposing it in shared shells, logs, or screenshots, which is the kind of privacy/security disclosure SQP-2 calls for in markdown files.
The example demonstrates authenticated access by placing the API key directly in an HTTP header, but the surrounding documentation does not warn about credential sensitivity. For markdown documentation, SQP-2 applies when behaviors affecting privacy or system integrity are described without corresponding cautionary language.
This example again uses X-CMC_PRO_API_KEY: your-api-key but provides no warning that the credential should be treated as secret. Repeating credential-bearing examples without any disclosure increases the chance of unsafe copy-paste use in terminals or shared documentation.
The example shows a network request carrying an API credential in a header, yet the documentation does not mention any security precautions. Under SQP-2 for markdown files, this is a missing warning because the described behavior can affect user privacy and account security if the key is mishandled.
This markdown file includes curl examples that send requests to CoinMarketCap using an X-CMC_PRO_API_KEY header, but it does not warn users that their API credential and request parameters will be transmitted to an external service. For markdown files, user-facing documentation should disclose behaviors that affect privacy or external data sharing.
The file describes an endpoint returning transaction data including maker_address, which can surface wallet activity information, but the markdown provides no caution about handling potentially sensitive on-chain address data. For markdown documentation, privacy-relevant behavior should be clearly disclosed when user actions may retrieve or process such data.
This is a markdown file, so SQP-2 applies to omissions in user-facing safety disclosures. The examples repeatedly show authenticated curl usage with X-CMC_PRO_API_KEY, yet the document does not warn users to keep the key secret or use secure handling practices when running commands.
No suspicious patterns detected.