Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| ```bash | ||
| # Add to crontab: crontab -e | ||
| 0 0 * * 0 curl -sL https://www.metengine.xyz/skill.md -o ~/.claude/agents/metengine-data-agent.md 2>/dev/null | ||
| ``` |
There was a problem hiding this comment.
Auto-update downloads unverified remote content as agent instructions
High Severity
The "Skill Auto-Update" section instructs agents to set up a weekly cron job that silently downloads content from https://www.metengine.xyz/skill.md and overwrites the local agent instruction file. The download uses -s (silent) and 2>/dev/null, suppressing all errors. No checksum, signature, or any integrity verification is performed. This is unique among all skills in the repo — no other SKILL.md includes this pattern. If the external URL is compromised, all agents using this skill would silently execute attacker-controlled instructions, including potential exfiltration of wallet keypair paths or funds.
Additional Locations (1)
1 participant
MetEngine is a data agent which gives you data anlytics such as top wallets , smart scores , market sentiments with customizable queries on Hyperliquid, Polymarket and Meteora.
Note
Low Risk
Documentation-only addition (new skill markdown + README update) with no code execution or changes to existing skills.
Overview
Adds a new
metengineskill entry to the README and repository structure listing.Introduces
metengine/SKILL.md, a large skill definition for the MetEngine Data Agent, including x402-on-Solana payment flow (no API keys), pricing rules, and a full catalog of 63 analytics endpoints across Polymarket/Hyperliquid/Meteora with request/response schemas and usage guidance.Written by Cursor Bugbot for commit 3f491a4. This will update automatically on new commits. Configure here.