price-threshold-alert
Monitors cryptocurrency price movements and sends real-time alerts for significant events like ATHs and sharp price changes.
Install this skill
Security score
The price-threshold-alert skill was audited on May 30, 2026 and we found 17 security issues across 3 threat categories, including 10 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 7 | > **${var}** — Optional. Pass one or more `target_price` levels (comma-separated USD numbers, scientific notation allowed) to fire a one-time alert when the price crosses any of them. Empty = only ATH |
Template literal with variable interpolation in command context
| 28 | - `memory/logs/${today}.md` — one log block per run, even on `OK`. |
Template literal with variable interpolation in command context
| 63 | - `targets.${price}.side` is `above` if `current_price < target` when the target was first observed (operator is waiting for the price to climb to it), and `below` otherwise. Set once, never flipped. |
Template literal with variable interpolation in command context
| 64 | - `targets.${price}.hit_at` is set the run the cross happens. `announced_at` is set the run the notification fires. They differ only if the run lands inside a dedup window — but target alerts never re |
Template literal with variable interpolation in command context
| 70 | - If `${var}` matches `^dry-run` → `MODE=dry-run`. Strip the prefix; remainder (if any) is treated as targets. |
Template literal with variable interpolation in command context
| 73 | - For each token: if it parses as a positive float (scientific notation OK, e.g. `5e-6`), include it. Reject zero / negative / non-numeric tokens and log `PRICE_ALERT_BAD_TARGET: ${token}` — continue |
Template literal with variable interpolation in command context
| 74 | - If after filtering the remainder was non-empty but yielded zero valid targets → log `PRICE_ALERT_BAD_VAR: ${var}` and exit (no notify). |
Template literal with variable interpolation in command context
| 92 | ```bash |
Template literal with variable interpolation in command context
| 99 | - Filter `.pairs[]` to entries where `.chainId == "${CHAIN}"`. |
Template literal with variable interpolation in command context
| 156 | ``` |
Template literal with variable interpolation in command context
| 168 | ``` |
Template literal with variable interpolation in command context
| 182 | ``` |
Template literal with variable interpolation in command context
| 219 | Append to `memory/logs/${today}.md`: |
Template literal with variable interpolation in command context
| 221 | ``` |
Template literal with variable interpolation in command context
| 249 | | `PRICE_ALERT_BAD_VAR` | `${var}` had non-empty, non-`dry-run` text but yielded zero valid targets | No | |
Curl to non-GitHub URL
| 93 | RESP=$(curl -fsS "https://api.dexscreener.com/latest/dex/tokens/${CONTRACT}" 2>/dev/null || echo "") |
External URL reference
| 93 | RESP=$(curl -fsS "https://api.dexscreener.com/latest/dex/tokens/${CONTRACT}" 2>/dev/null || echo "") |