Security audit

Fomo App Data Api

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only helper for querying public Fomo App data through ReplyNodes, with no evidence of hidden execution or data theft.

Before installing, make sure you trust ReplyNodes with the API key usage and understand that requests may consume prepaid credits. Store the key only in the agent secret store and use billing caps if you choose a paid plan.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (18)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
md
Every operation is an HTTP GET and reads public data only: - `leaderboard` — `GET https://api.replynodes.com/v1/fomo/leaderboard/{window}`. Read public Fomo leaderboard data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_trending` — `GET https://api.replynodes.com/v1/fomo/tokens/trending`. Read public trending-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_most_held` — `GET https://api.replynodes.com/v1/fomo/tokens/most-held`. Read public most-held-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number. - `tokens_graduated` — `GET https://api.replynodes.com/v1/fomo/tokens/graduated`. Read public graduated-token data Cost is determined by the authoritative Fomo catalog; do not infer or quote a number.