Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent NFT market lookup and analytics tool that uses disclosed public APIs and limited local JSON history storage.
Install only if you are comfortable with the skill contacting MintGarden, Dexie, and IPFS/Web3.Storage-style URLs for NFT market data and keeping local JSON market-history files under the skill directory when tracking is used. No wallet credentials or private keys should be provided to this skill.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const COLLECTION_ID = 'col10hfq4hml2z0z0wutu3a9hvt60qy9fcq4k4dznsfncey4lu6kpt3su7u9ah';
const MINTGARDEN_API = 'https://api.mintgarden.io';
const DEXIE_API = 'https://api.dexie.space/v1';
class WojakAPI {
constructor() {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const COLLECTION_ID = 'col10hfq4hml2z0z0wutu3a9hvt60qy9fcq4k4dznsfncey4lu6kpt3su7u9ah';
const MINTGARDEN_API = 'https://api.mintgarden.io';
const DEXIE_API = 'https://api.dexie.space/v1';
class WojakAPI {
constructor() {
The changelog documents persistent local storage of sales and price history data, but provides no user-facing warning that running the skill creates and retains files on disk. This is a genuine transparency and privacy issue because users may not expect market activity tracking data to persist across runs, especially when stored under a home-directory skill path.
Mentioning automatic backups without warning users means the skill may create additional copies of locally stored data beyond the primary JSON files, increasing retention and discoverability of stored information. While the data described is not highly sensitive on its face, silent duplication broadens the privacy footprint and can surprise users or complicate cleanup.
The feature description explicitly states that the skill stores historical market data locally and retrieves NFT and marketplace data from multiple external APIs, but it provides no warning about persistence, retention, or outbound network access. This is a real transparency and privacy issue: users may not realize the skill writes JSON files to disk and contacts third-party services, which can expose usage patterns, queried assets, and locally retained data.
The skill advertises historical data storage and tracking but does not disclose what data is retained, for how long, or whether user-triggered actions cause persistent storage. Even if the stored data is only market data, undocumented retention can surprise users and operators and creates avoidable privacy and governance risk.
The documentation identifies third-party APIs later in the file but does not clearly warn users, at the point of use or in a privacy/network notice, that commands transmit queries to external services. Users may reasonably assume local analysis, so the omission weakens informed consent and can expose search terms or usage patterns to external operators.
The code formats dates using toLocaleDateString() and toLocaleTimeString() without specifying a locale or offering user control. This makes output depend on the runtime environment's default locale, which can violate language/locale policy expectations when users are not given an explicit choice.
The dependency is specified with a caret range (^2.6.7), which allows automatic installation of newer compatible releases within the major version. This weakens supply-chain reproducibility and can expose consumers to a compromised or breaking upstream release without any change to this repository.
"author": "Jeff Coleman",
"license": "MIT",
"dependencies": {
"node-fetch": "^2.6.7"
}
}
No suspicious patterns detected.