Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small market-signal API wrapper with disclosed paid premium behavior, but users should know it contacts an external service and may return a crypto payment prompt.
Install only if you are comfortable sending ticker queries to the external Zo Computer API and potentially seeing a premium 402 payment request. The artifact does not auto-pay, trade, alter accounts, read local files, or persist anything, but its documentation should better disclose the exact endpoint and paid features.
The skill appears to have network-capable behavior but does not declare any tool scope or allowed-tools restrictions. That creates an authorization and transparency gap: a host or user may not be clearly informed that external connections can occur, increasing the risk of unexpected outbound requests, data exposure, or misuse of remote paid services.
The skill mentions that premium signals require a 402 payment proof, but the description does not clearly warn users up front about paid behavior. This can mislead users into invoking a skill that may trigger payment-related flows or dependency on a commercial service without informed consent, which is especially relevant for a trading-related skill where users may act on time-sensitive outputs.
The skill makes an external network request to a third-party API without clearly disclosing that behavior in the tool description or comments. This is risky because invoking the skill sends user-supplied ticker data to an external service and may expose usage metadata or create trust/privacy concerns, especially in an agent environment where users may assume processing is local.
No suspicious patterns detected.
