ClawHub

CoinGecko Price

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward CoinGecko price lookup skill with minor transparency and input-handling notes but no evidence of hidden, destructive, or data-stealing behavior.

Reasonable to install for ordinary crypto price checks. Be aware that search terms, coin IDs, and currency codes are sent to CoinGecko, and avoid entering private information into those fields.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill clearly relies on outbound network access to query the CoinGecko API, but the documentation does not declare that capability as a permission. Undeclared network use weakens transparency and policy enforcement, making it easier for a skill to access external services without clear user or platform awareness, though the stated purpose here is consistent with the skill's function rather than overtly malicious.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal