Security audit
Security checks for vulnerabilities and agentic risk
This finance skill is a straightforward PRISM API wrapper, but users should know their symbols, natural-language queries, and wallet addresses may be sent to the PRISM service.
Install only if you are comfortable sending finance queries, asset symbols, contract identifiers, and wallet addresses to the configured PRISM API host. Avoid using it for confidential trading strategy, private portfolio details, or wallet addresses you do not want associated with this provider, and prefer explicit PRISM-related prompts to avoid accidental calls.
The skill demonstrates repeated shell-based network access via curl but does not declare any tool scope or allowed-tools boundary. In agent environments, this can lead to the skill being invoked with broader execution capability than users expect, increasing the chance of unintended external calls or misuse of shell access.
The skill is fundamentally designed around transmitting user-supplied symbols and natural-language finance queries to an external API, and the examples begin doing so immediately. While this appears to be the intended function rather than overtly malicious behavior, it is still a real external data transmission risk because user inputs may contain sensitive or proprietary trading interests.
# Resolve symbol (handles BTC, BTCUSD, XBT, bitcoin, etc.)
curl "$PRISM_URL/resolve/BTC"
curl "$PRISM_URL/resolve/BTCUSDT"
curl "$PRISM_URL/resolve/bitcoin"
The wallet and on-chain examples encourage sending wallet addresses and contract identifiers to an external service without any privacy notice. Wallet addresses can be sensitive metadata because they enable transaction history correlation, asset profiling, and user deanonymization when transmitted to a third party.
The use-case triggers are phrased very broadly (e.g. common user questions like 'how's the market' or 'what's the price of bitcoin'), which can cause an agent to activate this skill in many ordinary conversations without clear user awareness. That increases the likelihood of unnecessary third-party API calls and data disclosure, especially when paired with shell/network capability.
The resolve-nl command posts arbitrary user-provided text directly to an external endpoint, creating an external transmission channel for potentially sensitive prompts, trading intent, or proprietary research questions. Because this is an agent skill for financial data, the context makes such leakage more significant: free-form financial queries can reveal positions, strategies, wallet targets, or internal analysis topics.
curl -s "$PRISM_URL/resolve/$2" | jq .
;;
resolve-nl)
curl -s -X POST "$PRISM_URL/agent/resolve" \
-H "Content-Type: application/json" \
-d "{\"query\": \"$2\"}" | jq .
;;
The script transmits user-supplied free-form input to a remote service in the resolve-nl path without any inline warning, consent step, or indication that entered data leaves the local environment. In an agent/tooling context, users may treat symbols, wallet identifiers, or natural-language prompts as routine local inputs, so silent exfiltration of potentially sensitive financial research queries increases privacy and data-handling risk.
The trigger phrase "check {token}" is very broad and can match many ordinary user requests that are not clearly intended to invoke this specific finance skill. In an agent environment, broad triggers can cause unintended activation, expanding the skill's reach and leading to unnecessary transmission of user queries or asset identifiers to an external API.
The trigger "what's trending" is insufficiently scoped and can collide with many general-purpose requests about news, social media, or markets. Because this skill sends requests to a finance API, accidental invocation could cause irrelevant external calls and incorrect agent routing, especially in multi-skill environments.
The phrase "fear and greed" overlaps with common finance discussion and may activate on casual conversation or educational questions, not just requests intended for this API-backed skill. In a financial assistant context, this increases the chance of unintended tool use and silent dependence on an external data provider for ambiguous user input.
No suspicious patterns detected.