crypto-gold-monitor

ISSUES FOUND max severity HIGHSkillSpector Caution 49 registry clawhub.ai last scanned 1 scan

3 findings (1 high, 2 medium), mainly data exfiltration, resource abuse, command injection. Most recent scan 2026-02-07.

This crypto/precious metals price monitoring skill presents MODERATE security risks. The most critical issue is a hardcoded API key (HIGH severity) that should be removed immediately and replaced with secure credential management. The skill also exhibits resource management concerns with unbounded retry logic and lacks proper input validation. However, the skill's core functionality appears legitimate - it monitors cryptocurrency and precious metal prices using public APIs. The network calls are to legitimate services (CoinGecko, GoldAPI.io, ExchangeRate-API) for their stated purpose. Missing optional metadata fields reduce transparency but don't pose direct security threats. The skill would benefit from implementing proper credential management, rate limiting, input validation, and cache cleanup mechanisms before production use.

Scanner's overall assessment (LLM analyzer)
Findings3
Critical0
High1
Medium2
Low0
Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 49
Score49 / 100
Issues4
CategoriesData Exfiltration Tool Misuse MCP Least Privilege
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

加密货币与贵金属价格监控 / Crypto & Precious Metals Price Monitor - 监控BTC/ETH实时价格、黄金(XAU)/白银(XAG)走势，免费API无需Key

Package
2 files, 14 KB
SKILL.md
329 words, 12+ sections
Code
Shell (1)

SKILL.md covers: 加密货币与贵金属价格监控 / Crypto & Precious Metals Price Monitor · 功能特性 / Features · 使用方法 / Usage · 1. 查看所有价格 / View All Prices · 2. 查看加密货币 / View Crypto · 查看比特币 · 查看以太坊 · 查看两者 · 3. 查看贵金属 / View Precious Metals · 查看黄金 · 查看白银 · 查看两者

Findings

HIGH Hardcoded API Key Exposure in Script Data Exfiltrationllm

The bash script contains a hardcoded API key for GoldAPI.io service (GOLD_API_KEY='goldapi-ckvbp2lv4z5n5-io'). Hardcoded credentials in scripts pose a significant security risk as they can be extracted and abused by attackers. This key could be used to exhaust API quotas, access paid services without authorization, or potentially access sensitive data depending on the API's capabilities.

crypto-monitor.sh:85

GOLD_API_KEY='goldapi-ckvbp2lv4z5n5-io'
Remediation: Remove hardcoded API key and implement secure credential management: 1) Use environment variables for API keys, 2) Document that users should obtain their own API keys, 3) Implement key validation and rotation mechanisms, 4) Add instructions in SKILL.md for secure credential configuration, 5) Consider using a secrets management system or encrypted configuration file
MEDIUM Unbounded Network Retry Logic Without Rate Limiting Resource Abusellm

The script implements retry logic for API calls but lacks proper rate limiting, timeout controls, and maximum retry bounds. The get_data() and get_exchange_rate() functions make external API calls with minimal timeout controls (--connect-timeout 3) but no comprehensive retry limits. This could lead to resource exhaustion if APIs are slow or unresponsive, potentially causing denial of service on the user's system through excessive CPU/network usage.

crypto-monitor.sh

Functions get_exchange_rate() and get_data() use curl with basic timeout but no retry limits or backoff strategy
Remediation: Implement proper rate limiting and retry controls: 1) Add maximum retry attempts (e.g., 3 retries), 2) Implement exponential backoff between retries, 3) Add total timeout limits for operations, 4) Implement circuit breaker pattern for failing APIs, 5) Add user-configurable rate limits, 6) Log retry attempts for debugging
MEDIUM Unsafe Command Execution with User-Controlled Input Command Injectionllm

The script uses user input directly in conditional logic and command execution paths without proper input validation or sanitization. While not directly using eval/exec, the script processes command-line arguments ($1, $2, etc.) and uses them in case statements and function calls. Malformed or malicious input could potentially cause unexpected behavior or command injection if the script is extended or modified.

crypto-monitor.sh

Case statement processes $1 directly: case "$1" in ... with minimal validation
Remediation: Implement strict input validation: 1) Whitelist allowed commands and parameters, 2) Validate all user inputs against expected patterns, 3) Sanitize inputs before use in any command execution, 4) Add input length limits, 5) Use parameter validation functions, 6) Implement proper error handling for invalid inputs

What is in the package

FileKindSize
SKILL.mddoc3.0 KB
crypto-monitor.shscript11 KB

External hosts referenced

api.coingecko.com api.exchangerate-api.com query1.finance.yahoo.com www.goldapi.io

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills