cmc-api-market

Pass

Audited by Gen Agent Trust Hub on Apr 10, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill documentation provides examples of curl commands to be executed via the Bash tool to fetch data from official CoinMarketCap API endpoints (pro-api.coinmarketcap.com). These are standard operational examples for the skill's primary purpose.
  • [CREDENTIALS_UNSAFE]: The documentation references the use of an API key (X-CMC_PRO_API_KEY) for authentication. It appropriately uses placeholders such as your-api-key in all examples and includes a guide for using the /v1/key/info endpoint to help users monitor their own API consumption and plan limits.
  • [PROMPT_INJECTION]: The skill facilitates the ingestion of external data, including news articles and user-generated community content (posts and comments) from CoinMarketCap. While this represents a surface for indirect prompt injection, it is an inherent characteristic of tools that read external web content, and the skill contains no malicious instructions or bypass attempts.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 10, 2026, 08:46 AM
Security Audit — agent-trust-hub — cmc-api-market