Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple paid market-signal lookup, but it asks for a wallet private key and can authorize paid calls automatically.
Review before installing. Use only a dedicated low-balance wallet for this skill, assume repeated agent-loop calls can spend USDC automatically, and avoid providing any primary trading, treasury, or high-value wallet private key.
The skill requires access to an EVM private key even though its advertised function is only to fetch a market regime label. While payment authorization may be part of the x402 model, exposing a signing key to a low-complexity informational skill expands secret access unnecessarily and increases the blast radius if the endpoint, client library, or calling workflow is compromised.
The skill states that the x402 client handles payment authorization automatically and shows passing the user's EVM private key, but it does not clearly warn that invoking the request may trigger paid wallet-authorized transactions. This can mislead operators into treating the call like an ordinary unauthenticated GET, causing unintended spending and unsafe handling of a highly sensitive secret.
No suspicious patterns detected.
