by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to implement the described crypto signal pipeline, but the package metadata omitted that an API key (NewsAPI) is required and the script will create a credentials file at ~/.openclaw/credentials/crypto-signal.json. Before installing or running: (1) inspect the full script yourself (or run it in a sandbox) to confirm there are no hidden network endpoints; (2) only provide the minimum keys needed (NewsAPI key), do not supply exchange/withdrawal credentials; (3) be aware the skil...详细分析 ▾
ℹ 用途与能力
Name/description match the included Python script: it fetches Binance klines and news, computes indicators and writes signal JSON. However, the registry metadata declares no required env vars/credentials while SKILL.md and the script require a NewsAPI key (NEWSAPI_KEY) and optionally other API keys — this mismatch is suspicious and should be clarified.
✓ 指令范围
SKILL.md instructions are scoped to running the script, reading/writing local signal JSON files, and using NewsAPI/CryptoPanic/Binance endpoints. The instructions do not ask to read unrelated system files or exfiltrate arbitrary data; they explicitly require only certain JSON fields when reading files.
✓ 安装机制
No install spec (instruction-only plus bundled script). Nothing is downloaded or executed at install time; the risk surface is limited to the included script which runs when invoked.
⚠ 凭证需求
The registry lists no required env vars, but SKILL.md and the script expect NEWSAPI_KEY (required) and optionally CRYPTOPANIC_KEY, BINANCE_API_KEY and proxy env vars. Binance endpoints used are public (do not strictly require an API key), so requiring a BINANCE_API_KEY is questionable. The script will create a credentials file at ~/.openclaw/credentials/crypto-signal.json (containing API keys) — that persistent credential storage is reasonable but you should verify where keys are stored and why the registry omitted them.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills or system-wide configs. It will create its own credentials file and write outputs under the skill workspace and ~/.openclaw; this is expected behavior for a local skill.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.52026/3/11
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install my-crypto-signal-skill
镜像加速npx clawhub@latest install my-crypto-signal-skill --registry https://cn.longxiaskill.com