Changenow

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:44 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed ChangeNOW swap helper, but it can create third-party crypto swap transactions with affiliate attribution and no built-in confirmation or financial safety warnings.

Review this carefully before installing. It is meant to route swaps through ChangeNOW with a partner fee, so only use it if you understand and accept the affiliate attribution, third-party transaction handling, and risk of irreversible crypto transfers. Prefer estimate-only use first, verify the asset, network, amount, and destination address independently, and avoid using a broadly privileged ChangeNOW API key.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/swap.py:9

Finding

API Credential Exposed in Request URLs

Content

View full analysis

Vulnerability Details

File Location: scripts/swap.py, lines 9–17
Vulnerability Type: API credential exposure through URL components
Risk Level: Medium

Vulnerable Code:

python

def get_estimate(from_coin, to_coin, amount, api_key):
    url = f"{API_BASE}/exchange-amount/{amount}/{from_coin}_{to_coin}/?api_key={api_key}"
    res = requests.get(url)
    if res.status_code == 200:
        return res.json()
    return {"error": res.text}

def create_transaction(from_coin, to_coin, amount, address, api_key):
    url = f"{API_BASE}/transactions/{api_key}"

Technical Analysis

The ChangeNOW API credential is embedded directly in a query string for estimate requests and in the URL path for transaction requests. Although the requests use HTTPS, TLS only protects the URL while it is in transit. Full request URLs can still be recorded by the destination service, reverse proxies, application monitoring systems, debugging tools, exception trackers, or local instrumentation.

Credential placement in URLs therefore exposes the API key to more systems and logs than necessary. This exceeds minimum-privilege data handling because only the ChangeNOW authentication layer needs access to the credential, while infrastructure that records request targets may also receive it.

The destination wallet address, asset identifiers, transaction amount, and disclosed affiliate identifier are operationally relevant to the declared swap functionality. No transmission to unrelated hosts was identified. The issue is specifically the insecure transport location of the API credential.

Attack Path

1. A request is made to ChangeNOW using a URL containing CHANGENOW_API_KEY.
2. A server, reverse proxy, monitoring agent, debugger, or exception-reporting system records the complete URL.
3. An attacker obtains access to those logs or telemetry records.
4. The attacker extracts the API key from the query string or URL path ...[truncated 834 chars]

Remediation

View remediation

Remediation Suggestions

1. Migrate to a current ChangeNOW endpoint that supports authentication through an HTTP authorization header rather than a query string or URL path.
2. Use a construction such as Authorization: Bearer ... or the exact dedicated API-key header required by the upstream API.
3. Ensure request logging, proxy logging, exception reporting, and application telemetry redact authorization values and sensitive URL fields.
4. Rotate the currently configured API key because it may already have appeared in historical logs.
5. Restrict the key to the minimum required API operations, apply rate limits, and enable account-side monitoring where supported.
6. Avoid including credentials in raised exceptions or diagnostic output.
7. If ChangeNOW mandates URL-based authentication for the selected API version, document the residual risk, disable full-URL logging throughout the request path, and use a narrowly scoped key.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/swap.py:36

Finding

Financial Amount Parsed Using Binary Floating-Point

Content

View full analysis

Vulnerability Details

File Location: scripts/swap.py, line 36
Vulnerability Type: Unsafe numeric representation for cryptocurrency amounts
Risk Level: Low

Vulnerable Code:

python

parser.add_argument("--amount", type=float, required=True)

Technical Analysis

The command-line transaction amount is parsed as a Python float. Binary floating-point cannot exactly represent many decimal fractions commonly used for cryptocurrency amounts. As a result, the value sent to the estimate or transaction API can differ subtly from the decimal amount entered by the user.

The same parsed value is also used in the displayed payment instruction:

python

print(f"Please send {args.amount} {args.from_coin.upper()} to: {data['payinAddress']}")

The implementation does not validate that the amount is positive, finite, within an acceptable range, or compatible with the selected asset's decimal precision. Values such as negative numbers, NaN, or infinity may consequently reach serialization or the remote API, although the upstream service may reject them.

Attack Path

1. A user or calling agent supplies a precision-sensitive decimal amount or a non-finite numeric value through --amount.
2. argparse converts the input to a binary floating-point value.
3. The converted value may no longer exactly match the decimal input.
4. The value is inserted into the estimate URL or serialized into the transaction request.
5. The API may quote or create a request using an altered amount, reject the request, or behave inconsistently.
6. The script may display payment instructions based on the converted value, creating a risk of user confusion or an incorrect transfer amount.

Impact Assessment

This issue does not grant additional system privileges or expose credentials. Its impact is limited to transaction integrity and availability.

Potential consequences include inaccurate quotes, rounding discr ...[truncated 250 chars]

Remediation

View remediation

Remediation Suggestions

1. Accept the amount as a string rather than converting it directly to float.
2. Validate it with a strict positive-decimal format that rejects signs where inappropriate, scientific notation if unsupported, NaN, and infinity.
3. Use Python's decimal.Decimal for validation or arithmetic.
4. Enforce the supported decimal precision, minimum amount, and maximum amount for the selected asset.
5. Preserve the normalized decimal string when constructing requests so that the exact user-approved value is transmitted.
6. Confirm the final amount with the user before presenting a deposit address or requesting a cryptocurrency transfer.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes a Python script that uses environment-provided API credentials and external network access, but the manifest declares no explicit tool scope or permissions. This creates unnecessary ambiguity about the skill's runtime capabilities and can lead to overbroad execution in environments that rely on manifest-declared boundaries for review and enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill encourages executing cryptocurrency swaps through a third-party exchange without clearly warning that funds will be transferred off-platform, addresses must be exact, and transactions may be irreversible. In a financial context, missing these disclosures materially increases the risk of user harm, including permanent asset loss, mistaken transfers, and uninformed consent to third-party custody/execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/swap.py (reported line 8)May include surrounding context.

python

import os
import sys

API_BASE = "https://api.changenow.io/v1"

def get_estimate(from_coin, to_coin, amount, api_key):
    url = f"{API_BASE}/exchange-amount/{amount}/{from_coin}_{to_coin}/?api_key={api_key}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The code transmits swap parameters to a third-party API, including asset pair, amount, and destination wallet address, which is an intentional external data flow. While necessary for functionality, it is still security-relevant because it shares sensitive transactional metadata with an external service and initiates the workflow for a real financial operation.

Content

Scanner excerpt · scripts/swap.py (reported line 29)May include surrounding context.

python

"userId": "",
        "contactEmail": ""
    }
    res = requests.post(url, json=payload)
    if res.status_code == 200:
        return res.json()
    return {"error": res.text}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script creates a real cryptocurrency swap immediately when --address is provided, with no interactive confirmation, preview of the destination, or explicit warning that funds will be committed. In a skill specifically designed to perform token swaps and inject an affiliate link_id, this increases the risk of accidental or socially engineered transfers, since users may trigger an irreversible external transaction with minimal friction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.