Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it creates a Consortium AI custodial wallet account through a disclosed external API, with no hidden persistence or unrelated local access found.
Install only if you intend to create Consortium AI custodial wallet accounts and trust Consortium AI with the provided wallet address and API key. Use a dedicated, scoped API key if available, and verify account/custody terms before using it with real funds or production users.
The skill requires environment access for TRADING_ANALYSIS_API_KEY and network access to an external API, but it does not declare any explicit tool scope such as permissions or allowed tools. This weakens review and runtime policy enforcement, making it easier for an agent or user to invoke external account-creation behavior without clear consent boundaries.
The skill initiates creation of custodial wallet accounts through a third-party API but does not present a clear user-facing warning about the external action, custodial nature, or data-sharing implications. In a crypto context, account creation can have legal, privacy, and asset-control consequences, so omitting a warning increases the risk of uninformed or unintended use.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
**Backend API base URL:** `https://api.consortiumai.org`
**Endpoint:** `POST https://api.consortiumai.org/api/custodial-wallet/create-with-api-key`
Creates a new custodial wallet account.
### Authentication
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
**Backend API base URL:** `https://api.consortiumai.org`
**Endpoint:** `POST https://api.consortiumai.org/api/custodial-wallet/create-with-api-key`
Creates a new custodial wallet account.
### Authentication
The script for creating Consortium AI custodial wallet accounts uses an environment variable named TRADING_ANALYSIS_API_KEY, which does not match the stated purpose or target service. This credential/documentation drift is dangerous because it can cause operators to supply an unrelated, over-privileged, or reused secret, increasing the chance of accidental credential exposure or misuse across systems.
Detected: suspicious.env_credential_access