Back to skill

Security audit

Cmc Api Exchange

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward CoinMarketCap exchange API reference skill, with expected API-key examples that users should handle carefully.

Before installing, understand that this skill teaches use of CoinMarketCap's external API and its examples require your CMC API key. Treat that key as sensitive, prefer environment variables or secure secret handling, and avoid pasting real keys into shared terminals, logs, screenshots, or committed files.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file includes curl examples that send requests to the CoinMarketCap API using an X-CMC_PRO_API_KEY header, but it does not include any user-facing warning about sharing credentials with a third-party service. For markdown files, external network actions involving credentials should disclose privacy or security implications when such warnings are otherwise absent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file includes curl examples that require sending an X-CMC_PRO_API_KEY header, but it does not warn readers to protect the key, avoid sharing it, or understand that requests will transmit credentials to a third-party service. Under the markdown-specific warning criterion, this is a user-facing omission about privacy and credential handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file includes multiple curl examples that send X-CMC_PRO_API_KEY to a remote service, which is a network operation involving credentials. The guide presents this usage as routine but does not warn users to protect the key, avoid shell history leakage, or understand that requests send authenticated data to an external API.

Content

No source excerpt is available for this finding.