coingecko
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices by recommending the use of environment variables for managing API keys and providing templates that implement rate limiting.\n- [SAFE]: Network operations are restricted to well-known and legitimate CoinGecko domains (api.coingecko.com and pro-api.coingecko.com). No unauthorized data exfiltration patterns were observed.\n- [SAFE]: No evidence of prompt injection, obfuscation (such as Base64 or zero-width characters), or dynamic execution of untrusted code was found across the skill documentation and code examples.\n- [SAFE]: The skill exhibits an indirect prompt injection surface as it processes external metadata. (1) Ingestion points: getTokenInfo and getPoolInfo retrieve external strings such as description, websites, and social media handles from the CoinGecko API. (2) Boundary markers: Absent in the templates. (3) Capability inventory: The skill uses fetch for network requests but lacks high-risk capabilities like file system writes or subprocess execution. (4) Sanitization: No specific sanitization of API-returned strings is performed.
Audit Metadata