Crypto Levels Analyzer

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is coherent for crypto technical analysis, with notable but disclosed use of local Python scripts, external market-data APIs, optional API keys, and a small local output file.

Before installing, understand that this skill may run local Python scripts and call external crypto market-data APIs. If you configure API keys, use read-only/data-only keys and do not grant trading or withdrawal permissions. Treat the trading analysis as educational information, not financial advice.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI05: Unexpected Code Execution

What this means

Using the command-line modes may run code from the skill package on the user’s machine.

Why it was flagged

The documentation includes user-directed commands for running local Python scripts. This is expected for the skill’s analysis function, but it means installation/use may involve local code execution.

Skill content

python3 scripts/analyze_quick.py SOL 177.70 2.31 60

Recommendation

Run the scripts only from the installed skill directory, avoid elevated privileges, and review local scripts if you plan to use command-line modes.

Note

ASI03: Identity and Privilege Abuse

What this means

If a user supplies an over-permissioned API key, misuse of that key could affect the associated provider or exchange account.

Why it was flagged

The skill supports optional market-data provider API keys. This is purpose-aligned, but exchange/provider credentials should be scoped because some services can issue keys with broader account privileges.

Skill content

export COINGECKO_API_KEY="your_key"
export COINMARKETCAP_API_KEY="your_key"
export BINANCE_API_KEY="your_key"

Recommendation

Use read-only or market-data-only keys where possible, never enable trading or withdrawal permissions for this skill, prefer environment variables, and apply IP restrictions if supported.

Note

ASI06: Memory and Context Poisoning

What this means

A local record of the analysis may remain on the machine after use.

Why it was flagged

Quick-mode analysis is documented as writing results to a local temporary JSON file. The content appears low sensitivity, but it is still a persistent local artifact.

Skill content

分析结果会自动保存到 `/tmp/crypto_analysis_quick.json`

Recommendation

Delete the temporary file if you do not want analysis results left on disk, especially on shared systems.