cmc-api-market
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation provides examples of
curlcommands to be executed via theBashtool to fetch data from official CoinMarketCap API endpoints (pro-api.coinmarketcap.com). These are standard operational examples for the skill's primary purpose. - [CREDENTIALS_UNSAFE]: The documentation references the use of an API key (
X-CMC_PRO_API_KEY) for authentication. It appropriately uses placeholders such asyour-api-keyin all examples and includes a guide for using the/v1/key/infoendpoint to help users monitor their own API consumption and plan limits. - [PROMPT_INJECTION]: The skill facilitates the ingestion of external data, including news articles and user-generated community content (posts and comments) from CoinMarketCap. While this represents a surface for indirect prompt injection, it is an inherent characteristic of tools that read external web content, and the skill contains no malicious instructions or bypass attempts.
Audit Metadata