Security audit
Security checks for vulnerabilities and agentic risk
The skill does what it claims, but its local scripts handle wallet/config input unsafely enough that crafted inputs could make them run unintended code.
Review or fix the scripts before installing. Use only trusted portfolio.json files and wallet/token/config inputs, and assume wallet addresses queried through the tool will be visible to public RPC providers and price/API services. Avoid enabling cron until you are comfortable with the ongoing network queries and history logging.
echo "================================"
# Get prices for native tokens
PRICES=$(curl -s "https://api.coingecko.com/api/v3/simple/price?ids=ethereum,solana,matic-network&vs_currencies=usd" 2>/dev/null)
ETH_PRICE=$(echo "$PRICES" | python3 -c "import sys,json; print(json.load(sys.stdin).get('ethereum',{}).get('usd',0))" 2>/dev/null)
SOL_PRICE=$(echo "$PRICES" | python3 -c "import sys,json; print(json.load(sys.stdin).get('solana',{}).get('usd',0))" 2>/dev/null)
MATIC_PRICE=$(echo "$PRICES" | python3 -c "import sys,json; print(json.load(sys.stdin).get('matic-network',{}).get('usd',0))" 2>/dev/null)No suspicious patterns detected.