goldrush-streaming-api
Fail
Audited by Snyk on Mar 10, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs embedding the API key in the WebSocket connection_init payload (and shows code with "YOUR_API_KEY"), which requires the agent to read and include secret values verbatim in requests.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill subscribes to live public blockchain and DEX data (e.g., walletTxs, newPairs, ohlcv streams) from the open WebSocket endpoint wss://streaming.goldrushdata.com/graphql as documented in SKILL.md and references/endpoints.md, so it ingests untrusted, user-generated on-chain content that agents are expected to read and that can directly drive trading/automation decisions.
Audit Metadata