Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward CoinMeta crypto news API helper that discloses its external API calls and required API key.
Install this only if you want your agent to query CoinMeta for crypto news and articles. Your COINMETA_API_KEY will be sent to CoinMeta when the documented API calls are made, and the broad 'market updates' trigger may be worth tightening if you only want explicit CoinMeta or crypto-news requests to use this skill.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
primaryEnv: COINMETA_API_KEY
requires:
bins:
- curl
env:
- COINMETA_API_KEY
os:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Endpoint: POST https://api.coinmeta.com/open/v1/newsflash/list
curl example:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Endpoint: POST https://api.coinmeta.com/open/v1/newsflash/list
curl example:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Endpoint: POST https://api.coinmeta.com/open/v1/newsflash/list
curl example:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Endpoint: POST https://api.coinmeta.com/open/v1/newsflash/list
curl example:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Endpoint: POST https://api.coinmeta.com/open/v1/newsflash/list
curl example:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Endpoint: POST https://api.coinmeta.com/open/v1/newsflash/list
curl example:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Endpoint: POST https://www.coinmeta.com/open/v1/newsflash/search
curl -s -X POST -H "Accept:*/*" \
-H "X-Api-Key: ${COINMETA_API_KEY}" \
-H "Content-Type: application/json" \
-d '{"page":1,"size":10,"keyword":"btc"}' \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Endpoint: POST https://api.coinmeta.com/open/v1/article/list
curl example:
curl -s -X POST -H "Accept:*/*" \
-H "X-Api-Key: ${COINMETA_API_KEY}" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Endpoint: POST https://api.coinmeta.com/open/v1/article/list
curl example:
curl -s -X POST -H "Accept:*/*" \
-H "X-Api-Key: ${COINMETA_API_KEY}" \
The manifest-style description lists trigger scenarios such as "crypto news" and especially "market updates," which are broad phrases that could overlap with ordinary user requests outside this specific API skill. The file does not provide exclusion conditions or clearer scope limits to distinguish when the skill should activate versus when a more general news or finance capability should handle the request.
No suspicious patterns detected.