Security audit
Security checks across malware telemetry and agentic risk
This appears to be a real DexScan market-data skill, but it needs review because it can use wallet analytics and searches parent .env files for API credentials.
Install only if you are comfortable sending token and wallet-analysis queries to DexScan. Provide DS_ACCESS_KEY and DS_SECRET_KEY through explicit environment configuration, and avoid placing DexScan credentials in parent project .env files where this skill could pick them up unintentionally. Be careful with outputs involving wallet addresses, PnL, tags, source addresses, emails, or social profiles, especially when analyzing someone else’s wallet.
const path = require('path');
const BASE_URI = 'https://openapi.dexscan.trade';
// 读取 .env 文件，从 dexscan-skill 目录向上逐级查找直到根目录
function readEnvFile() {
const envConfig = {};
let currentDir = __dirname;const envConfig = {};
let currentDir = __dirname;
// 向上逐级查找 .env 文件，直到根目录
while (true) {
const envPath = path.join(currentDir, '.env');
if (fs.existsSync(envPath)) {// 向上逐级查找 .env 文件，直到根目录
while (true) {
const envPath = path.join(currentDir, '.env');
if (fs.existsSync(envPath)) {
const content = fs.readFileSync(envPath, 'utf-8');
content.split('\n').forEach(line => {64/64 vendors flagged this skill as clean.
Detected: suspicious.env_credential_access