Security audit

Fomo App Data Api

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only connector for Fomo public market data through ReplyNodes, with the main caution being its long-lived API key and prepaid-credit usage.

Install only if you are comfortable using ReplyNodes as a paid or prepaid gateway for Fomo public data. Protect the REPLYNODES_API_KEY like a password, monitor credit usage, and avoid asking the agent to treat returned user balances, trades, alerts, or notifications as private unless Fomo and ReplyNodes explicitly document that access model.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Intent-Code Divergence

Medium

Confidence: 82% confidence
Finding: The summary states this operation reads "public Fomo notifications," but notifications are ordinarily user-scoped data and the file also defines a bearer authorization header, suggesting authenticated access. This creates an intent-level contradiction between the documentation labeling the data as public and the apparent authenticated, potentially private nature of the endpoint.

External Transmission

Medium

Category: Data Exfiltration
Content: Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `token_holders` — `GET https://api.replynodes.com/v1/fomo/tokens/{address}/holders`. Read public token-holder data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `token_holders` — `GET https://api.replynodes.com/v1/fomo/tokens/{address}/holders`. Read public token-holder data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_profile` — `GET https://api.replynodes.com/v1/fomo/users/{handle}`. Read a public Fomo user profile Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `token_holders` — `GET https://api.replynodes.com/v1/fomo/tokens/{address}/holders`. Read public token-holder data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_profile` — `GET https://api.replynodes.com/v1/fomo/users/{handle}`. Read a public Fomo user profile Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_trades` — `GET https://api.replynodes.com/v1/fomo/users/{handle}/trades`. Read public user trade history Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `token_holders` — `GET https://api.replynodes.com/v1/fomo/tokens/{address}/holders`. Read public token-holder data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_profile` — `GET https://api.replynodes.com/v1/fomo/users/{handle}`. Read a public Fomo user profile Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_trades` — `GET https://api.replynodes.com/v1/fomo/users/{handle}/trades`. Read public user trade history Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_balances` — `GET https://api.replynodes.com/v1/fomo/users/{handle}/balances`. Read public user balance data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `token_holders` — `GET https://api.replynodes.com/v1/fomo/tokens/{address}/holders`. Read public token-holder data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_profile` — `GET https://api.replynodes.com/v1/fomo/users/{handle}`. Read a public Fomo user profile Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_trades` — `GET https://api.replynodes.com/v1/fomo/users/{handle}/trades`. Read public user trade history Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_balances` — `GET https://api.replynodes.com/v1/fomo/users/{handle}/balances`. Read public user balance data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `trade` — `GET https://api.replynodes.com/v1/fomo/trades/{trade_id}`. Read one public trade Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `token_holders` — `GET https://api.replynodes.com/v1/fomo/tokens/{address}/holders`. Read public token-holder data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_profile` — `GET https://api.replynodes.com/v1/fomo/users/{handle}`. Read a public Fomo user profile Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_trades` — `GET https://api.replynodes.com/v1/fomo/users/{handle}/trades`. Read public user trade history Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_balances` — `GET https://api.replynodes.com/v1/fomo/users/{handle}/balances`. Read public user balance data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `trade` — `GET https://api.replynodes.com/v1/fomo/trades/{trade_id}`. Read one public trade Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis` — `GET https://api.replynodes.com/v1/fomo/thesis`. Read public Fomo theses Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: - `token_holders` — `GET https://api.replynodes.com/v1/fomo/tokens/{address}/holders`. Read public token-holder data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_profile` — `GET https://api.replynodes.com/v1/fomo/users/{handle}`. Read a public Fomo user profile Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_trades` — `GET https://api.replynodes.com/v1/fomo/users/{handle}/trades`. Read public user trade history Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_balances` — `GET https://api.replynodes.com/v1/fomo/users/{handle}/balances`. Read public user balance data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `trade` — `GET https://api.replynodes.com/v1/fomo/trades/{trade_id}`. Read one public trade Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis` — `GET https://api.replynodes.com/v1/fomo/thesis`. Read public Fomo theses Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_token` — `GET https://api.replynodes.com/v1/fomo/thesis/token/{mint}`. Read public theses for a token Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: - `user_profile` — `GET https://api.replynodes.com/v1/fomo/users/{handle}`. Read a public Fomo user profile Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_trades` — `GET https://api.replynodes.com/v1/fomo/users/{handle}/trades`. Read public user trade history Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_balances` — `GET https://api.replynodes.com/v1/fomo/users/{handle}/balances`. Read public user balance data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `trade` — `GET https://api.replynodes.com/v1/fomo/trades/{trade_id}`. Read one public trade Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis` — `GET https://api.replynodes.com/v1/fomo/thesis`. Read public Fomo theses Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_token` — `GET https://api.replynodes.com/v1/fomo/thesis/token/{mint}`. Read public theses for a token Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_user` — `GET https://api.replynodes.com/v1/fomo/thesis/user/{id}`. Read public theses by a user Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: - `user_trades` — `GET https://api.replynodes.com/v1/fomo/users/{handle}/trades`. Read public user trade history Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `user_balances` — `GET https://api.replynodes.com/v1/fomo/users/{handle}/balances`. Read public user balance data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `trade` — `GET https://api.replynodes.com/v1/fomo/trades/{trade_id}`. Read one public trade Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis` — `GET https://api.replynodes.com/v1/fomo/thesis`. Read public Fomo theses Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_token` — `GET https://api.replynodes.com/v1/fomo/thesis/token/{mint}`. Read public theses for a token Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_user` — `GET https://api.replynodes.com/v1/fomo/thesis/user/{id}`. Read public theses by a user Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_user_token` — `GET https://api.replynodes.com/v1/fomo/thesis/user/{id}/token/{address}`. Read public user-token theses Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: - `user_balances` — `GET https://api.replynodes.com/v1/fomo/users/{handle}/balances`. Read public user balance data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `trade` — `GET https://api.replynodes.com/v1/fomo/trades/{trade_id}`. Read one public trade Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis` — `GET https://api.replynodes.com/v1/fomo/thesis`. Read public Fomo theses Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_token` — `GET https://api.replynodes.com/v1/fomo/thesis/token/{mint}`. Read public theses for a token Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_user` — `GET https://api.replynodes.com/v1/fomo/thesis/user/{id}`. Read public theses by a user Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_user_token` — `GET https://api.replynodes.com/v1/fomo/thesis/user/{id}/token/{address}`. Read public user-token theses Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `search` — `GET https://api.replynodes.com/v1/fomo/search`. Search public Fomo data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: - `trade` — `GET https://api.replynodes.com/v1/fomo/trades/{trade_id}`. Read one public trade Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis` — `GET https://api.replynodes.com/v1/fomo/thesis`. Read public Fomo theses Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_token` — `GET https://api.replynodes.com/v1/fomo/thesis/token/{mint}`. Read public theses for a token Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_user` — `GET https://api.replynodes.com/v1/fomo/thesis/user/{id}`. Read public theses by a user Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_user_token` — `GET https://api.replynodes.com/v1/fomo/thesis/user/{id}/token/{address}`. Read public user-token theses Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `search` — `GET https://api.replynodes.com/v1/fomo/search`. Search public Fomo data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `alerts` — `GET https://api.replynodes.com/v1/fomo/alerts`. Read public Fomo alerts Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: - `thesis` — `GET https://api.replynodes.com/v1/fomo/thesis`. Read public Fomo theses Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_token` — `GET https://api.replynodes.com/v1/fomo/thesis/token/{mint}`. Read public theses for a token Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_user` — `GET https://api.replynodes.com/v1/fomo/thesis/user/{id}`. Read public theses by a user Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_user_token` — `GET https://api.replynodes.com/v1/fomo/thesis/user/{id}/token/{address}`. Read public user-token theses Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `search` — `GET https://api.replynodes.com/v1/fomo/search`. Search public Fomo data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `alerts` — `GET https://api.replynodes.com/v1/fomo/alerts`. Read public Fomo alerts Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `notifications` — `GET https://api.replynodes.com/v1/fomo/notifications`. Read public Fomo notifications Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: - `thesis_by_token` — `GET https://api.replynodes.com/v1/fomo/thesis/token/{mint}`. Read public theses for a token Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_user` — `GET https://api.replynodes.com/v1/fomo/thesis/user/{id}`. Read public theses by a user Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_user_token` — `GET https://api.replynodes.com/v1/fomo/thesis/user/{id}/token/{address}`. Read public user-token theses Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `search` — `GET https://api.replynodes.com/v1/fomo/search`. Search public Fomo data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `alerts` — `GET https://api.replynodes.com/v1/fomo/alerts`. Read public Fomo alerts Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `notifications` — `GET https://api.replynodes.com/v1/fomo/notifications`. Read public Fomo notifications Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: - `thesis_by_user` — `GET https://api.replynodes.com/v1/fomo/thesis/user/{id}`. Read public theses by a user Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `thesis_by_user_token` — `GET https://api.replynodes.com/v1/fomo/thesis/user/{id}/token/{address}`. Read public user-token theses Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `search` — `GET https://api.replynodes.com/v1/fomo/search`. Search public Fomo data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `alerts` — `GET https://api.replynodes.com/v1/fomo/alerts`. Read public Fomo alerts Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `notifications` — `GET https://api.replynodes.com/v1/fomo/notifications`. Read public Fomo notifications Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. ## Request and response behavior
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: - `thesis_by_user_token` — `GET https://api.replynodes.com/v1/fomo/thesis/user/{id}/token/{address}`. Read public user-token theses Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `search` — `GET https://api.replynodes.com/v1/fomo/search`. Search public Fomo data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `alerts` — `GET https://api.replynodes.com/v1/fomo/alerts`. Read public Fomo alerts Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `notifications` — `GET https://api.replynodes.com/v1/fomo/notifications`. Read public Fomo notifications Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. ## Request and response behavior
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.