ClawHub
Back to skill

Security audit

crypto-supply-dilution-tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small crypto supply-analysis helper that openly calls CoinGecko and does not show hidden data access, persistence, or destructive behavior.

Install only if you are comfortable with the skill making live requests to CoinGecko when you run it. It does not need an API key and does not appear to read local secrets or persist data, but its output is a supply-side proxy and should not be treated as investment advice.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill explicitly states it pulls live data from CoinGecko's public API, which means it performs network access despite having no declared permissions. Undeclared network capability weakens transparency and permission-based trust boundaries, making it easier for a user or platform to invoke external communications they did not explicitly authorize or review.

Static analysis

No suspicious patterns detected.