Security audit
Security checks for vulnerabilities and agentic risk
This read-only DeFi API skill is mostly purpose-aligned, but its privacy claims conflict with its IP-based limits and possible wallet-to-IP tier handling.
Review the API operator's privacy policy or source before using wallet-scan or holder-tier features. Avoid submitting wallet addresses you do not want linked to your IP address until the service clearly documents rate-limit storage, logs, retention, and whether wallet addresses can be associated with network metadata.
The documentation makes a strong privacy claim that IP addresses are not stored or logged, yet the skill also states rate limits are enforced per IP. Even if only transiently processed, per-IP enforcement necessarily involves handling IP-linked state, so the current wording is misleading and can cause users to disclose wallet activity under false privacy assumptions.
The skill says requests are anonymous and involve no wallet identification, but then describes associating a requesting IP with an address to enforce holder tiers. That creates an identity/linkage contradiction: users may believe requests are unlinkable when the service may correlate wallet addresses with network identifiers, exposing behavioral and financial privacy risk.
No suspicious patterns detected.
