ClawHub
Back to skill

Security audit

Cmc Mcp

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed market-data helper that installs a CLI and uses API keys to fetch crypto, Binance public, FRED, and market-signal data.

Install only if you are comfortable adding a global npm CLI and giving it a Methodalgo API key. Prefer an environment variable for the key, keep the CLI updated, and treat generated market analysis as informational rather than financial advice.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

High
Confidence
94% confidence
Finding
The trigger and description instruct the agent to use this skill for essentially any cryptocurrency-related discussion, including cases where the user did not explicitly request external data. That broad routing can cause unnecessary tool invocation, over-collection of third-party data, and reduced user intent fidelity, especially for general educational, opinion, or safety-sensitive discussions that do not require live market access.

Static analysis

No suspicious patterns detected.