Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward crypto price API/CLI wrapper with expected network access and no evidence of hidden persistence, credential theft, destructive behavior, or unrelated system access.
Before installing, prefer a pinned npm version or lockfile-managed dependency instead of unpinned npx examples, and only set PRISM_API_KEY or PRISM_API_URL if you trust the API endpoint receiving those requests. Do not use returned market data as the sole basis for financial decisions.
The README instructs users to execute the package via npx realtime-crypto-price-api without pinning a specific version. This can cause consumers to fetch and run whatever version is current at execution time, increasing supply-chain risk if a malicious or compromised release is published later.
This npx usage example executes an unpinned package version from the registry. If the package is later hijacked, typosquatted, or updated with malicious code, users following the documentation may directly run attacker-controlled code.
The documentation encourages running the package through npx without version pinning, which makes behavior non-deterministic and exposes users to future malicious releases. In a cryptocurrency-related tool, this is more sensitive because users may rely on the output for trading or automation and are a valuable target for supply-chain attacks.
Using npx realtime-crypto-price-api without a fixed version allows the executed code to change over time without the user's awareness. A compromised maintainer account or malicious update could turn a harmless CLI invocation into arbitrary code execution on the user's machine.
This unpinned npx example has the same supply-chain exposure as the other CLI examples: users execute the latest registry version at runtime rather than a reviewed, fixed release. Because the package is positioned for dashboards, bots, and crypto workflows, attackers may see elevated value in compromising downstream users.
The skill documents installation and runtime usage that inherently require network access and may access environment configuration, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may use broader capabilities than intended, making the skill harder to sandbox and review safely.
Using npx realtime-crypto-price-api without a pinned version causes execution of whatever package version is current at runtime. If the package is compromised, typosquatted, or updated maliciously, users or agents may fetch and execute unreviewed code immediately.
This npx realtime-crypto-price-api invocation is not version-pinned, so execution depends on the latest package contents available from the registry at the time of use. That exposes users to supply-chain risk, including compromised releases or dependency hijacking.
Running the package through unpinned npx means the skill can trigger download and execution of code that was not the version originally reviewed. In an agent context, that is especially risky because the command may be executed automatically with network access and user trust.
The unpinned npx command introduces a classic supply-chain execution hazard by resolving to the latest registry state rather than a fixed artifact. In a skill intended for trading bots and dashboards, this increases the chance of automated execution in sensitive environments.
Detected: suspicious.env_credential_access
