moralis-streams-api
Enables real-time blockchain event monitoring with webhooks for tracking wallet addresses and token transfers across EVM chains.
Install this skill
Security score
The moralis-streams-api skill was audited on May 29, 2026 and we found 43 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 205 | ```bash |
Curl to non-GitHub URL
| 60 | curl "https://api.moralis-streams.com/streams/evm?limit=10" \ |
Curl to non-GitHub URL
| 209 | curl "https://api.moralis-streams.com/streams/evm?limit=100" \ |
Curl to non-GitHub URL
| 213 | curl -X PUT "https://api.moralis-streams.com/streams/evm" \ |
Curl to non-GitHub URL
| 226 | curl -X POST "https://api.moralis-streams.com/streams/evm/<stream_id>/status" \ |
Curl to non-GitHub URL
| 299 | curl -X PUT "https://api.moralis-streams.com/streams/evm" \ |
Webhook reference - potential data exfiltration
| 3 | description: Real-time blockchain event monitoring with webhooks. Use when user asks about setting up webhooks, real-time event streaming, monitoring wallet addresses, tracking token transfers in real |
Webhook reference - potential data exfiltration
| 142 | "error" // CORRECT - auto-set when webhook success rate <70% |
Webhook reference - potential data exfiltration
| 156 | 6. **Not returning 200 on test webhook** - Stream won't start unless your endpoint returns 2xx on the test webhook sent during create/update |
Webhook reference - potential data exfiltration
| 164 | Enrich webhook data with on-chain reads (e.g., `balanceOf`). Triggers execute `view`/`pure` functions and attach results to webhook events. Supports dynamic selectors (`$contract`, `$from`, `$to`). Se |
Webhook reference - potential data exfiltration
| 168 | ## Native Balances in Webhooks |
Webhook reference - potential data exfiltration
| 170 | Configure `getNativeBalances` to include native token balances (ETH, BNB, etc.) in webhook payloads. Requires Business plan+. See [references/UsefulStreamOptions.md](references/UsefulStreamOptions.md) |
Webhook reference - potential data exfiltration
| 176 | - **Two webhooks per event**: Unconfirmed (`confirmed: false`) + Confirmed (`confirmed: true`). Idempotent handlers required. |
Webhook reference - potential data exfiltration
| 177 | - **Streams auto-terminate after 24 hours in error state** (webhook success rate <70%). This is **unrecoverable** — you must create a new stream. |
Webhook reference - potential data exfiltration
| 178 | - **Test webhook**: Sent on every create/update. Must return 200 or stream won't start. |
Webhook reference - potential data exfiltration
| 184 | ## Webhook Security |
Webhook reference - potential data exfiltration
| 186 | Webhooks are signed with your streams secret (different from API key). |
Webhook reference - potential data exfiltration
| 199 | See [references/WebhookSecurity.md](references/WebhookSecurity.md) for complete examples. |
Webhook reference - potential data exfiltration
| 206 | WEBHOOK_URL="https://your-server.com/webhook" |
Webhook reference - potential data exfiltration
| 217 | "webhookUrl": "'${WEBHOOK_URL}'", |
Webhook reference - potential data exfiltration
| 238 | | "400 Bad Request" | Invalid config | Check webhookUrl, topic0 format, chainIds | |
Webhook reference - potential data exfiltration
| 242 | | "No webhooks" | Stream paused | Check status is "active" | |
Webhook reference - potential data exfiltration
| 268 | | [GetStreamBlockDataByNumber](rules/GetStreamBlockDataByNumber.md) | Get webhook data returned on the block number with provided stream config | |
Webhook reference - potential data exfiltration
| 269 | | [GetStreamBlockDataToWebhookByNumber](rules/GetStreamBlockDataToWebhookByNumber.md) | Send webhook based on a specific block number using stream config and addresses. | |
Webhook reference - potential data exfiltration
| 303 | "webhookUrl": "https://your-server.com/webhook", |
Webhook reference - potential data exfiltration
| 343 | - [references/DeliveryGuarantees.md](references/DeliveryGuarantees.md) - At-least-once delivery, dual webhooks, confirmation blocks, test webhooks |
Webhook reference - potential data exfiltration
| 346 | - [references/FilterStreams.md](references/FilterStreams.md) - Webhook data filtering to reduce noise |
Webhook reference - potential data exfiltration
| 349 | - [references/ReplayFailedWebhooks.md](references/ReplayFailedWebhooks.md) - Replay failed webhook guide |
Webhook reference - potential data exfiltration
| 354 | - [references/WebhookResponseBody.md](references/WebhookResponseBody.md) - Webhook payload structure |
Webhook reference - potential data exfiltration
| 355 | - [references/WebhookSecurity.md](references/WebhookSecurity.md) - Signature verification |
Access to .env file
| 45 | 2. If not set, offer to create the `.env` file with an empty placeholder: `MORALIS_API_KEY=` |
Access to .env file
| 46 | 3. Tell the user to open the `.env` file and paste their key there themselves. |
Access to .env file
| 53 | The `.env` file location depends on how skills are installed: |
Access to .env file
| 55 | Create the `.env` file in the project root (same directory the user runs Claude Code from). Make sure `.env` is in `.gitignore`. |
External URL reference
| 49 | If they don't have a key yet, point them to [admin.moralis.com/register](https://admin.moralis.com/register) (free, no credit card). |
External URL reference
| 60 | curl "https://api.moralis-streams.com/streams/evm?limit=10" \ |
External URL reference
| 69 | https://api.moralis-streams.com |
External URL reference
| 206 | WEBHOOK_URL="https://your-server.com/webhook" |
External URL reference
| 209 | curl "https://api.moralis-streams.com/streams/evm?limit=100" \ |
External URL reference
| 213 | curl -X PUT "https://api.moralis-streams.com/streams/evm" \ |
External URL reference
| 226 | curl -X POST "https://api.moralis-streams.com/streams/evm/<stream_id>/status" \ |
External URL reference
| 299 | curl -X PUT "https://api.moralis-streams.com/streams/evm" \ |
External URL reference
| 303 | "webhookUrl": "https://your-server.com/webhook", |