CoinFound-Skill
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a coherent read-only CoinFound data skill; the main thing to notice is that it runs bundled Python code to make external CoinFound API requests.
Before installing, be comfortable with a Python-based skill making read-only HTTPS requests to CoinFound. Avoid using the schema probe’s snapshot-writing option unless you intentionally want to update local bundled schema files.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the skill may send endpoint, path-parameter, and query choices to CoinFound’s API to retrieve public RWA data.
The bundled Python fetcher makes live HTTP requests. This is disclosed and central to the skill’s read-only CoinFound data purpose, but users should know the agent can contact the external CoinFound API when invoked.
request = Request(request_context["url"], method=entry["method"]) ... with urlopen(request, timeout=timeout) as response:
Use the skill for intended CoinFound data lookups and review endpoint/query parameters before asking the agent to fetch data.
Users have less provenance information for the publisher/source of the skill, even though the included code appears purpose-aligned.
The registry metadata does not identify an upstream source or homepage. The bundled artifacts are still simple and self-contained, with no install script or package dependency evidence.
Source: unknown Homepage: none
Install only if you are comfortable with the listed owner and the bundled source code; prefer skills with clear upstream provenance when available.