Security audit
Security checks for vulnerabilities and agentic risk
This skill mainly reads CoinFound RWA API data; it includes opt-in schema-writing helper code, but normal use is scoped to user-directed API reads.
Before installing, be comfortable with the agent making user-directed requests to CoinFound's API. Treat the skill's normal workflow as read-oriented, and avoid running probe_schema.py with --write-snapshot or calling the write helper functions in environments that require strict no-write behavior.
Writing schema snapshot files and actively probing endpoint schemas contradicts the claimed read-only design. In this context, that is more dangerous because the skill is presented as a safe, bundled-data reader; unexpected writes can tamper with trusted local artifacts, and active schema probing can introduce uncontrolled network interactions and persistence of untrusted remote data.
Writing schema snapshot files and actively probing endpoint schemas contradicts the claimed read-only design. In this context, that is more dangerous because the skill is presented as a safe, bundled-data reader; unexpected writes can tamper with trusted local artifacts, and active schema probing can introduce uncontrolled network interactions and persistence of untrusted remote data.
Writing schema snapshot files and actively probing endpoint schemas contradicts the claimed read-only design. In this context, that is more dangerous because the skill is presented as a safe, bundled-data reader; unexpected writes can tamper with trusted local artifacts, and active schema probing can introduce uncontrolled network interactions and persistence of untrusted remote data.
The module exposes write_catalog(), which can modify bundled package data despite the skill being ներկայացված as read-only. This creates an integrity and trust-boundary issue: downstream code or an agent could mutate the local endpoint catalog, causing later reads to consume attacker-influenced endpoint metadata or schemas.
The skill advertises executable behavior via bundled Python scripts and network-backed data access, but it does not declare any explicit tool scope or permissions. That creates an authorization and review gap: operators cannot reliably constrain file, write, or network capabilities from the manifest, increasing the chance of unintended access or misuse.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
DATA_DIR = PACKAGE_ROOT / "data"
DEFAULT_CATALOG_PATH = DATA_DIR / "endpoint_catalog.json"
SNAPSHOT_DIR = DATA_DIR / "schema_snapshots"
BASE_URL = "https://api.coinfound.org/api/kakyoin"
def load_catalog(path: Path | None = None) -> list[dict[str, Any]]:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
DATA_DIR = PACKAGE_ROOT / "data"
DEFAULT_CATALOG_PATH = DATA_DIR / "endpoint_catalog.json"
SNAPSHOT_DIR = DATA_DIR / "schema_snapshots"
BASE_URL = "https://api.coinfound.org/api/kakyoin"
def load_catalog(path: Path | None = None) -> list[dict[str, Any]]:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
DATA_DIR = PACKAGE_ROOT / "data"
DEFAULT_CATALOG_PATH = DATA_DIR / "endpoint_catalog.json"
SNAPSHOT_DIR = DATA_DIR / "schema_snapshots"
BASE_URL = "https://api.coinfound.org/api/kakyoin"
def load_catalog(path: Path | None = None) -> list[dict[str, Any]]:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
DATA_DIR = PACKAGE_ROOT / "data"
DEFAULT_CATALOG_PATH = DATA_DIR / "endpoint_catalog.json"
SNAPSHOT_DIR = DATA_DIR / "schema_snapshots"
BASE_URL = "https://api.coinfound.org/api/kakyoin"
def load_catalog(path: Path | None = None) -> list[dict[str, Any]]:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
DATA_DIR = PACKAGE_ROOT / "data"
DEFAULT_CATALOG_PATH = DATA_DIR / "endpoint_catalog.json"
SNAPSHOT_DIR = DATA_DIR / "schema_snapshots"
BASE_URL = "https://api.coinfound.org/api/kakyoin"
def load_catalog(path: Path | None = None) -> list[dict[str, Any]]:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
DATA_DIR = PACKAGE_ROOT / "data"
DEFAULT_CATALOG_PATH = DATA_DIR / "endpoint_catalog.json"
SNAPSHOT_DIR = DATA_DIR / "schema_snapshots"
BASE_URL = "https://api.coinfound.org/api/kakyoin"
def load_catalog(path: Path | None = None) -> list[dict[str, Any]]:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
DATA_DIR = PACKAGE_ROOT / "data"
DEFAULT_CATALOG_PATH = DATA_DIR / "endpoint_catalog.json"
SNAPSHOT_DIR = DATA_DIR / "schema_snapshots"
BASE_URL = "https://api.coinfound.org/api/kakyoin"
def load_catalog(path: Path | None = None) -> list[dict[str, Any]]:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
DATA_DIR = PACKAGE_ROOT / "data"
DEFAULT_CATALOG_PATH = DATA_DIR / "endpoint_catalog.json"
SNAPSHOT_DIR = DATA_DIR / "schema_snapshots"
BASE_URL = "https://api.coinfound.org/api/kakyoin"
def load_catalog(path: Path | None = None) -> list[dict[str, Any]]:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
DATA_DIR = PACKAGE_ROOT / "data"
DEFAULT_CATALOG_PATH = DATA_DIR / "endpoint_catalog.json"
SNAPSHOT_DIR = DATA_DIR / "schema_snapshots"
BASE_URL = "https://api.coinfound.org/api/kakyoin"
def load_catalog(path: Path | None = None) -> list[dict[str, Any]]:
The skill is described as read-only, but probe_endpoint_schema can persist snapshot files when write_snapshot_file is enabled. This breaks the advertised trust boundary and can create unintended local side effects, including writing potentially sensitive response excerpts to disk in a predictable path.
This function performs live network probing and can optionally write probe results to disk without any visible warning, consent, or disclosure in the code path. In a skill marketed as read-only, undisclosed outbound requests and persistence increase the risk of surprising data exposure, policy violations, and misuse in restricted environments.
The manifest describes the skill as a read-only CoinFound RWA data skill backed by bundled endpoint catalogs and schema snapshots. However, this module implements write_snapshot, which creates directories and writes JSON snapshot files to disk, introducing a mutating capability inconsistent with a read-only description.
A skill whose stated purpose is to read bundled RWA data and schema snapshots does not obviously require the ability to create directories and write new snapshot files at runtime. This persistence capability goes beyond the justified implementation needs of consuming bundled read-only data.
This function performs an outbound HTTP request and reads remote response data, but there is no confirmation prompt, logging, print statement, or explanatory comment/docstring in the file disclosing that network transmission occurs. For a code file, outbound network activity is a safety-relevant operation that should have some visible user disclosure unless documented elsewhere.
The write_snapshot function creates directories and writes JSON snapshot data to a file, which is a file-write operation covered by the missing-warning rule for code files. This code has no confirmation prompt, logging, print statement, docstring, or comment disclosing that user or system data may be persisted to disk.
No suspicious patterns detected.