CoinFound-Skill

Read-only CoinFound RWA data skill backed by a bundled endpoint catalog and schema snapshots.

Security Scan

The skill is internally coherent: it bundles a local endpoint catalog and schema snapshots and implements read-only GET calls to a single CoinFound API without requesting credentials or unexplained permissions.

Purpose & Capability

Name/description, bundled catalog, schema snapshots, CLI scripts, and Python code all match a read-only RWA data reader. Required binaries (python3/python) are appropriate and no unrelated credentials or system paths are requested.

Instruction Scope

SKILL.md instructs reading bundled files and running the provided fetch script. The runtime code performs GET requests only to the CoinFound base URL and returns normalized/display data as described. The probe scripts can perform live probes and optionally write snapshots, which is documented and separate from the read flow.

Install Mechanism

No install spec is provided (instruction-only). The bundle includes Python source and CLI scripts but does not fetch external installers or archives during 'installation', so there is no remote install risk in the manifest.

Credentials

The skill requests no environment variables or credentials. The code performs unauthenticated GETs to the documented CoinFound API endpoints; requesting no secrets is proportionate to the stated read-only purpose.

Persistence & Privilege

always is false and the skill does not request persistent platform privileges. Probe code can write snapshot files only when explicitly invoked with the write option; it does not modify other skills or global agent settings.

Assessment

This bundle is consistent with a read-only data reader: it will run Python scripts and make unauthenticated GET requests to https://api.coinfound.org/api/kakyoin using the bundled catalog and snapshots. The probe CLI can perform live probes and — only if you run it with the snapshot-write option — persist snapshot files into the bundle directory. No credentials or extra environment variables are requested. If you install this skill, verify you trust the CoinFound domain and are comfortable allowing the agent to perform outbound HTTPS GETs; consider running it in a restricted environment if you need to limit network access.

CoinFound RWA Read

Self-contained read-only access to CoinFound RWA GET endpoints.

Scope

• Supports aggregates, timeseries, pie, list, and dataset routes under v1/c/rwa/*.
• Does not refresh schema snapshots. Hand unresolved schema gaps to $coinfound-rwa-schema-probe.

Workflow

1. Read the bundled endpoint catalog and schema snapshots before constructing a request.
2. Resolve the route by endpoint_key or by asset_class + family + metric.
3. Run the bundled fetch script and return both the envelope and normalized payload.
4. If the schema is missing or conflicts with live data, delegate to $coinfound-rwa-schema-probe.

Bundled Resources

Read first:

• shared/coinfound_rwa/data/endpoint_catalog.json
• shared/coinfound_rwa/data/schema_snapshots/

Run:

• shared/coinfound_rwa/scripts/fetch_rwa.py

Minimal Examples

python3 shared/coinfound_rwa/scripts/fetch_rwa.py \
  --endpoint-key stable-coin.market-cap.timeseries \
  --query '{"groupBy":"network"}'

python3 shared/coinfound_rwa/scripts/fetch_rwa.py \
  --asset-class private-credit \
  --family aggregates

Expected Output

Default output should include:

• request
• response_envelope
• normalized_data
• display_data
• shape_family
• schema_source

References

• references/rwa-read-workflow.md
• references/rwa-read-capabilities.md
• references/rwa-read-integration-notes.md