MemeCoin分析师

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:48 AM UTC
• Version: 1.0.0

Overview

The skill’s memecoin-analysis purpose is coherent, but the published documentation exposes a credential-shaped payment/API key that users should review before installing.

Review this skill before installing or using it. The main issue is the exposed API/payment key in the published documentation; the publisher should remove it, rotate it, and document safe credential handling. If self-hosting, use your own key through an environment variable with spending limits, and treat the crypto analysis as informational rather than investment advice.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:18

Finding

Hardcoded API Credential in Skill Documentation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18
Vulnerability Type: Hardcoded secret / exposed API credential
Risk Level: High

Vulnerable Code Snippet

markdown

- **API Key**: `sk_e0c26b0e9826d17c309bd5030cbe95ef04ed33cf4f05c03dae0f23358ee5e956`

Technical Analysis

A credential-shaped API key is embedded directly in the distributable Skill documentation. Any user or system with access to the project can read and copy it without authentication.

If the exposed key is active and accepted by SkillPay or an associated API, an attacker could reuse it outside the intended Skill. Secrets committed to project files must be considered compromised because removing them from the current version does not remove copies from package archives, caches, logs, forks, or version-control history.

Attack Path

1. An attacker downloads or reads the Skill package.
2. The attacker opens SKILL.md and extracts the key from line 18.
3. The attacker identifies the service or API that accepts the credential.
4. The attacker submits requests using the exposed key.
5. If the key remains valid, requests execute under the associated account's authorization and billing context.

Exploitation depends on the key being active and on its server-side permissions.

Impact Assessment

A valid exposed key may permit unauthorized API use, paid-quota consumption, billing abuse, rate-limit exhaustion, and impersonation of the associated service account. The exact scope is limited to the permissions assigned to the credential and cannot be determined from the available file. No evidence indicates access to host operating-system privileges or cryptocurrency private keys.

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate the exposed key immediately.
2. Remove the credential from SKILL.md and replace it with a clearly invalid placeholder such as your_api_key.
3. Remove the secret from version-control history, release archives, registries, caches, and published Skill packages where feasible.
4. Load operational credentials from environment variables or a managed secret store rather than source files or documentation.
5. Apply least-privilege permissions, spending limits, rate limits, expiration, and service restrictions to replacement credentials.
6. Review provider access and billing logs for unauthorized use of the exposed key.
7. Add automated secret scanning to pre-commit and CI workflows to prevent recurrence.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation contains a live-looking API key in plaintext, which is an unjustified secret exposure for a market-analysis skill. Exposed credentials can be reused by anyone who reads the file to access paid services, impersonate the skill, incur charges, or abuse linked backend resources; the financial/payment context makes this more dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Publishing an API key in plaintext without any credential-handling guidance normalizes unsafe secret practices and directly leaks a usable credential. Because the skill includes pricing and payment integration, misuse could lead to unauthorized consumption, billing fraud, service abuse, and possible compromise of associated accounts or infrastructure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language instructions, examples, and outputs are entirely Chinese, and the skill does not indicate that language selection is optional or that the tool is intentionally region-specific. Under the language/locale policy rule, forcing a specific language without user opt-in is a policy concern.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.