ClawHub
Back to skill

Security audit

Cmc X402

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only skill for CoinMarketCap x402 paid API access; its payment and wallet requirements are disclosed and purpose-aligned.

Install only if you intend to use CoinMarketCap x402 paid endpoints. Use a dedicated low-balance hot wallet, keep the private key in environment variables or a secrets manager, and review each integration path before enabling automatic paid requests.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The manifest says to use the skill when users 'want CMC data without API keys, ask about pay-per-request APIs' and lists triggers like 'pay per request' and 'no API key'. These phrases are broad and may appear in ordinary discussion unrelated to this specific CoinMarketCap x402 skill, with no negative examples or scope limits to prevent accidental activation.

Static analysis

No suspicious patterns detected.