T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:122- Finding
API Keys Are Solicited Through Chat and Retrieved from Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
CoinGecko API
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate CoinGecko API helper, but it needs review because it handles API keys unsafely and recommends broad mutable installation commands.
Review before installing. Prefer a pinned, local install path, do not paste API keys into chat or let the agent save them in memory, use a secure secret or environment variable, and use header-based authentication instead of putting keys in URLs.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/core.md:55- Finding
Authentication Guidance Permits API Keys in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:29- Finding
Unpinned Third-Party Packages Are Installed and Executed Globally
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (16)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
git clone https://github.com/coingecko/skills.git coingecko-skills
Move to your agent's skills directory (example: Claude Code on Mac/Linux)
mv coingecko-skills ~/.claude/skills/coingecko
text *The exact path may vary based on your agent and operating system.*
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger scope is broad enough to capture general cryptocurrency questions that may not specifically require CoinGecko or GeckoTerminal. This can cause the agent to over-invoke the skill, bias tool selection, and route users into unnecessary credential/API workflows, increasing the chance of incorrect delegation or denial of answering when simpler non-tool responses would suffice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file contains skill-routing guidance embedded in reference content that uses broad natural-language triggers like coin prices, market trends, and anything powered by CoinGecko or GeckoTerminal APIs. Overly broad activation criteria can cause the agent to invoke this skill for loosely related requests, increasing the chance of incorrect tool use, unnecessary external data access, and prompt-scope hijacking via ambiguous user phrasing.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Plan | Base URL | Auth header | Query param | |---|---|---|---| | **Paid (Pro)** | `https://pro-api.coingecko.com/api/v3` | `x-cg-pro-api-key: KEY` | `?x_cg_pro_api_key=KEY` | | **Demo** | `https://api.coingecko.com/api/v3` | `x-cg-demo-api-key: KEY` | `?x_cg_demo_api_key=KEY` | | **Keyless** | `https://api.coingecko.com/api/v3` | *(omit all auth)* | *(omit all auth)* | Use header or query param — not both.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Plan | Base URL | Auth header | Query param | |---|---|---|---| | **Paid (Pro)** | `https://pro-api.coingecko.com/api/v3` | `x-cg-pro-api-key: KEY` | `?x_cg_pro_api_key=KEY` | | **Demo** | `https://api.coingecko.com/api/v3` | `x-cg-demo-api-key: KEY` | `?x_cg_demo_api_key=KEY` | | **Keyless** | `https://api.coingecko.com/api/v3` | *(omit all auth)* | *(omit all auth)* | Use header or query param — not both.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Plan | Base URL | Auth header | Query param | |---|---|---|---| | **Paid (Pro)** | `https://pro-api.coingecko.com/api/v3` | `x-cg-pro-api-key: KEY` | `?x_cg_pro_api_key=KEY` | | **Demo** | `https://api.coingecko.com/api/v3` | `x-cg-demo-api-key: KEY` | `?x_cg_demo_api_key=KEY` | | **Keyless** | `https://api.coingecko.com/api/v3` | *(omit all auth)* | *(omit all auth)* | Use header or query param — not both.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Plan | Base URL | Auth header | Query param | |---|---|---|---| | **Paid (Pro)** | `https://pro-api.coingecko.com/api/v3` | `x-cg-pro-api-key: KEY` | `?x_cg_pro_api_key=KEY` | | **Demo** | `https://api.coingecko.com/api/v3` | `x-cg-demo-api-key: KEY` | `?x_cg_demo_api_key=KEY` | | **Keyless** | `https://api.coingecko.com/api/v3` | *(omit all auth)* | *(omit all auth)* | Use header or query param — not both.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Plan | Base URL | Auth header | Query param | |---|---|---|---| | **Paid (Pro)** | `https://pro-api.coingecko.com/api/v3` | `x-cg-pro-api-key: KEY` | `?x_cg_pro_api_key=KEY` | | **Demo** | `https://api.coingecko.com/api/v3` | `x-cg-demo-api-key: KEY` | `?x_cg_demo_api_key=KEY` | | **Keyless** | `https://api.coingecko.com/api/v3` | *(omit all auth)* | *(omit all auth)* | Use header or query param — not both.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Plan | Base URL | Auth header | Query param | |---|---|---|---| | **Paid (Pro)** | `https://pro-api.coingecko.com/api/v3` | `x-cg-pro-api-key: KEY` | `?x_cg_pro_api_key=KEY` | | **Demo** | `https://api.coingecko.com/api/v3` | `x-cg-demo-api-key: KEY` | `?x_cg_demo_api_key=KEY` | | **Keyless** | `https://api.coingecko.com/api/v3` | *(omit all auth)* | *(omit all auth)* | Use header or query param — not both.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Plan | Base URL | Auth header | Query param | |---|---|---|---| | **Paid (Pro)** | `https://pro-api.coingecko.com/api/v3` | `x-cg-pro-api-key: KEY` | `?x_cg_pro_api_key=KEY` | | **Demo** | `https://api.coingecko.com/api/v3` | `x-cg-demo-api-key: KEY` | `?x_cg_demo_api_key=KEY` | | **Keyless** | `https://api.coingecko.com/api/v3` | *(omit all auth)* | *(omit all auth)* | Use header or query param — not both.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Plan | Base URL | Auth header | Query param | |---|---|---|---| | **Paid (Pro)** | `https://pro-api.coingecko.com/api/v3` | `x-cg-pro-api-key: KEY` | `?x_cg_pro_api_key=KEY` | | **Demo** | `https://api.coingecko.com/api/v3` | `x-cg-demo-api-key: KEY` | `?x_cg_demo_api_key=KEY` | | **Keyless** | `https://api.coingecko.com/api/v3` | *(omit all auth)* | *(omit all auth)* | Use header or query param — not both.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guidance explicitly says to ask the user to provide their API key, but it gives no safety instruction about minimizing collection, avoiding storage/logging, or preferring existing secure secret mechanisms. In an agent setting, this can lead to unnecessary solicitation of sensitive credentials in chat and accidental exposure through conversation history, telemetry, or downstream tool calls.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file includes an activation-style instruction that is very broad: 'Load this file for any request involving DEX pool data.' Because it covers 'any request' in a large topic area without exclusions or negative examples, it could overlap with many adjacent crypto or token-analysis requests and cause unnecessary invocation.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The exploratory phrase "What crypto data is available?" is underspecified and may match a wide range of high-level or comparative questions that do not clearly require this specific skill. In practice, this can produce unnecessary activation and steer the conversation toward CoinGecko-specific handling even when the user is only asking generally about crypto datasets or options.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file instructs the agent to load this reference for broad natural-language requests such as corporate Bitcoin treasuries, government crypto holdings, and entity-level crypto data, without tightly defining boundaries or disambiguation rules. This can cause over-triggering or inappropriate skill selection, which may lead the agent to pull in external-data behavior when the user intent is only loosely related, increasing the risk of scope confusion and unintended API use.
- Content
Static analysis
No suspicious patterns detected.