Price for Agent

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is aligned with price lookups, but users should know it sends queries to a third-party API and uses a service API key.

This appears safe to install for price lookups. Before using it, understand that it depends on a third-party API, requires a service API key, and may transmit your query text to that service. Keep the API key private and avoid including sensitive portfolio or trading information in requests.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

If the key is exposed, someone else could consume your service quota or make requests associated with your agent for this price service.

Why it was flagged

The skill expects a service-specific API key for the price API. This is purpose-aligned, but the key is still a credential and should be handled carefully.

Skill content

Register for API Key ... Response: {"api_key": "pfa_xxx..."} ... -H "X-API-Key: YOUR_KEY"

Recommendation

Generate a dedicated key, store it securely, and rotate or revoke it if exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

If a query includes portfolio holdings, trade plans, or other private details, those details may be transmitted to the service.

Why it was flagged

Natural-language market queries are sent to a third-party endpoint. This is expected for a hosted price service, but user-supplied query text may be visible to that provider.

Skill content

**Base URL:** `https://p4ai.bitharga.com` ... -d '{"query": "What is the price of Bitcoin and Ethereum?"}'

Recommendation

Use only the minimum necessary asset symbols or query text, and avoid including sensitive financial or personal information.