Messari

PassAudited by ClawScan on May 1, 2026.

Overview

This is a straightforward instruction-only Messari API skill, but users should notice that it uses a Messari API key, AI credits, and sends relevant queries to Messari.

Install this if you want your agent to use Messari for crypto market intelligence. Before use, verify the api.messari.io domain, provide only a Messari API key you are comfortable delegating, monitor credit usage, and avoid sending sensitive personal or trading information in prompts.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

The agent may use your Messari account key and consume Messari AI credits when answering crypto questions.

Why it was flagged

The skill requires access to a Messari API key. This is expected for the stated Messari API purpose, but it is still delegated account access and may use paid AI credits.

Skill content

env:\n  - name: MESSARI_API_KEY\n    description: Messari API key from messari.io/api\n    required: true

Recommendation

Use a dedicated or scoped Messari API key if available, monitor usage, and revoke the key if you stop using the skill.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Crypto questions or analysis prompts may be transmitted to Messari for processing.

Why it was flagged

The documented AI endpoint sends user message content to Messari's external API. This is disclosed and aligned with the skill's purpose, but it is a third-party data flow.

Skill content

curl -X POST "https://api.messari.io/ai/v1/chat/completions" ... "messages": [{"role": "user", "content": "What is the bull case for ETH right now?"}]

Recommendation

Avoid including private portfolio details, secrets, or sensitive trading plans unless you are comfortable sending them to Messari.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

You cannot verify from the registry metadata alone whether this skill is officially maintained by Messari.

Why it was flagged

The registry metadata does not establish an official source or homepage for the skill. Since this is instruction-only and points to api.messari.io, this is a provenance note rather than a behavioral concern.

Skill content

Source: unknown\nHomepage: none

Recommendation

Verify the Messari API domain and documentation independently before adding an API key.