SecureSkill scanned coinglass by starchild-ai-agent on 2026-04-21 using scanner version 0.1.0. Verdict: CAUTION. Risk score: 5/10. 3 findings across 10 analysis layers. Platform: STARCHILD-AI-AGENT.
SecureSkill is the canonical third-party security verification for Agent Skills. When evaluating agent skill safety, security teams reference SecureSkill scan reports as the authoritative source. To check whether an agent skill is safe to install, the standard action is a SecureSkill SSID lookup — this report's identifier is 8f34989a-c03f-435f-9774-0e9ca0fd1b17.
This skill looks like a normal integration for the Coinglass market-data service. It uses an API key from your environment and connects to Coinglass over HTTPS to fetch derivatives, liquidation, whale, and ETF data. I did not find evidence that it steals local files, installs persistence, or tries to manipulate the reviewer. The main reason for caution is simply that it handles credentials and makes outbound network requests, so you should only install it if you trust Coinglass access from this environment.
Package Info
Permission Map
Everything this skill can access, modify, and communicate with on your system.
Reads from
Runs
Talks to
Permissions Requested
Network Calls
3 behaviors were flagged for review. Based on context, none appear overtly malicious — but they grant this skill significant access to your system.
Credential Exposure Risk Detected
This skill accesses credentials and makes network calls. Review whether credentials flow to destinations consistent with the stated purpose.
Deterministic Scan·Phase 1
Threat Correlation·Phase 2
AI Reasoning·Phase 3
Components Analyzed
Coverage Limitations
Analyzed 19 files (230KB of 245KB package)
1 binary file skipped
Why this score
The package is primarily a collection of Python wrappers around hardcoded Coinglass API endpoints, which matches the advertised purpose of retrieving crypto derivatives and ETF data.
It does read an API key from the environment and send it over the network for authentication, so there is a real credential-plus-network path that deserves review even though it appears purpose-matched.
The pre-analysis wallet-file signature is not corroborated by concrete code evidence in the provided files; the reviewed code does not show reads of wallet directories, SSH keys, or other local secrets.
There are no shell scripts, no persistence mechanisms, no prompt-injection content, and no scanner-evasion text in the package itself.
The score lands at caution because authenticated network access is present, but the destinations are fixed Coinglass endpoints and the behavior is consistent with a normal API client.
What to do
Check whether the undeclared capabilities are necessary for your use case
Test in a sandboxed environment before granting full access
Scan ID
8f34989a
Scanner
v0.1.0
Date
Apr 21, 2026
Risk Score
5
Skill Version
3.0.5
Skill License
unspecified