Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Messari crypto data API guide with expected third-party API calls and no hidden execution, persistence, or destructive behavior.
Install only if you are comfortable sending crypto research queries and your Messari API key to Messari's service. Do not include private keys, seed phrases, wallet credentials, or confidential personal/business data in prompts or API requests.
The skill’s activation criteria are excessively broad, ending with 'any blockchain/crypto data question,' which can cause it to trigger for a very wide range of requests. Overbroad routing increases the chance that unrelated or sensitive user prompts get sent to an external crypto data provider unnecessarily, expanding data exposure and making downstream prompt/data handling harder to control.
This example shows sending user-provided prompt content to Messari’s AI chat completion endpoint along with an API key. Transmitting free-form user content to a third-party AI service can expose sensitive information if prompts contain confidential data, and the broad skill scope makes such transmission more likely.
curl -X POST "https://api.messari.io/ai/v1/chat/completions" \
-H "x-messari-api-key: $MESSARI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
This example shows sending user-provided prompt content to Messari’s AI chat completion endpoint along with an API key. Transmitting free-form user content to a third-party AI service can expose sensitive information if prompts contain confidential data, and the broad skill scope makes such transmission more likely.
curl -X POST "https://api.messari.io/ai/v1/chat/completions" \
-H "x-messari-api-key: $MESSARI_API_KEY" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl "https://api.messari.io/metrics/v2/assets?assetSlugs=bitcoin,ethereum" \
-H "x-messari-api-key: $MESSARI_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl "https://api.messari.io/metrics/v2/assets?assetSlugs=bitcoin,ethereum" \
-H "x-messari-api-key: $MESSARI_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl "https://api.messari.io/metrics/v2/assets?assetSlugs=bitcoin,ethereum" \
-H "x-messari-api-key: $MESSARI_API_KEY"
The document instructs users to send an API key in a header and to submit chat prompts to Messari's external AI endpoints, but it does not warn that both credentials and user-provided content will leave the local environment and be processed by a third party. In a skill that may handle portfolio, research, or other sensitive user queries, this omission can lead to unintended disclosure of secrets or confidential data through normal use.
No suspicious patterns detected.