Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Crypto Market Data Skill (No Key Required)

No API KEY needed for free tier. Professional-grade cryptocurrency and stock market data integration for real-time prices, company profiles, and global analytics. Powered by Node.js with zero external dependencies.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
8 · 8.6k · 75 current installs · 81 all-time installs
byLiam@liam8
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Name/description (fetching crypto & stock market data) aligns with the included scripts and the single API client; no unrelated binaries, credentials, or heavy installs are requested.
Instruction Scope
SKILL.md instructs running the included Node.js scripts and documents the token flow and the token endpoint (https://api.igent.net/api/token). The implementation additionally honors an undocumented API_BASE_URL environment variable (overrides BASE_URL), which SKILL.md does not mention — small documentation mismatch that could be used to change the remote endpoint.
Install Mechanism
There is no install spec and package.json declares no dependencies — the scripts use only Node.js standard libs as claimed, so nothing is downloaded or written during install. Risk from install mechanism is low.
Credentials
The skill does not request credentials or environment variables in metadata. The only implicit env var in code is API_BASE_URL (optional override) and an optional process.env.API_BASE_URL is used to set the remote endpoint; no secret/env requirements are demanded up front.
Persistence & Privilege
The api client writes a local '.token' file under the scripts directory to persist temporary tokens. This is expected for session reuse but is persistent state written to disk and should be treated as sensitive (contains token and expires_at). The skill is not force-enabled (always: false) and does not modify other skills.
Assessment
This skill appears to do what it says (market data queries) and does not ask for your private credentials, but it connects to an external service (https://api.igent.net by default) and writes a session token to a hidden .token file in the skill directory. Before installing or running it: 1) Verify you trust api.igent.net or the skill's origin (no homepage/source listed). 2) Run it in a sandbox or low-privilege environment first so the token file and network calls are isolated. 3) Inspect the .token file contents and remove it if you no longer want persisted tokens. 4) Be aware that setting API_BASE_URL (an undocumented override present in code) can redirect requests to another endpoint — avoid running in sensitive environments where that could be abused. If you cannot confirm the provider's reputation, treat it as untrusted code and avoid running it on machines with sensitive data or credentials.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.2
Download zip
latestvk9745qrvy2bnwfk4txnn3chg1x81344e

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Crypto & Stock Market Data Skill (Node.js)

A comprehensive suite of tools for retrieving real-time and historical cryptocurrency and stock market data. This skill interfaces with a dedicated market data server to provide high-performance, authenticated access to global financial statistics. Built entirely on Node.js standard libraries — no npm install required.

Key Capabilities

CategoryDescription
Real-time PricesFetch current valuations, market caps, 24h volumes, and price changes for crypto & stocks.
Market DiscoveryTrack trending assets and top-performing coins by market capitalization.
Smart SearchQuickly find coin IDs or stock tickers by searching names or symbols.
Deep DetailsAccess exhaustive asset information, from community links to company profiles.
Precise ChartsRetrieve OHLC candlestick data and historical price/volume time-series.
Global MetricsMonitor total market capitalization and public company treasury holdings.

Tool Reference

Script NamePrimary FunctionCommand Example
get_crypto_price.jsMulti-coin price fetchnode scripts/get_crypto_price.js bitcoin
get_stock_quote.jsReal-time stock quotesnode scripts/get_stock_quote.js AAPL MSFT
get_company_profile.jsCompany overviewnode scripts/get_company_profile.js AAPL
search_stocks.jsFind stock tickersnode scripts/search_stocks.js apple
get_trending_coins.js24h trending assetsnode scripts/get_trending_coins.js
get_top_coins.jsMarket leaderboardsnode scripts/get_top_coins.js --per_page=20
search_coins.jsAsset discoverynode scripts/search_coins.js solana
get_coin_details.jsComprehensive metadatanode scripts/get_coin_details.js ethereum
get_coin_ohlc_chart.jsCandlestick datanode scripts/get_coin_ohlc_chart.js bitcoin
get_coin_historical_chart.jsTime-series datanode scripts/get_coin_historical_chart.js bitcoin
get_global_market_data.jsMacro market statsnode scripts/get_global_market_data.js
get_public_companies_holdings.jsTreasury holdingsnode scripts/get_public_companies_holdings.js bitcoin
get_supported_currencies.jsValuation optionsnode scripts/get_supported_currencies.js

Usage Details

1. get_crypto_price.js

Fetch real-time pricing and basic market metrics for one or more cryptocurrencies.

Syntax:

node scripts/get_crypto_price.js <coin_id_1> [coin_id_2] ... [--currency=usd]

Parameters:

  • coin_id: The unique identifier for the coin (e.g., bitcoin, solana).
  • --currency: The target currency for valuation (default: usd).

Example:

node scripts/get_crypto_price.js bitcoin ethereum cardano --currency=jpy

2. get_top_coins.js

Retrieve a list of the top cryptocurrencies ranked by market capitalization.

Syntax:

node scripts/get_top_coins.js [--currency=usd] [--per_page=10] [--page=1] [--order=market_cap_desc]

Parameters:

  • --currency: Valuation currency (default: usd).
  • --per_page: Number of results (1-250, default: 10).
  • --order: Sorting logic (e.g., market_cap_desc, volume_desc).

3. get_coin_ohlc_chart.js

Get Open, High, Low, Close (candlestick) data for technical analysis.

Syntax:

node scripts/get_coin_ohlc_chart.js <coin_id> [--currency=usd] [--days=7]

Allowed days values: 1, 7, 14, 30, 90, 180, 365.

RangeResolution
1-2 Days30 Minute intervals
3-30 Days4 Hour intervals
31+ Days4 Day intervals

4. get_coin_historical_chart.js

Retrieve detailed historical time-series data for price, market cap, and volume.

Syntax:

node scripts/get_coin_historical_chart.js <coin_id> [--currency=usd] [--days=30]

5. get_stock_quote.js

Fetch real-time stock prices for one or more ticker symbols.

Syntax:

node scripts/get_stock_quote.js <SYMBOL_1> [SYMBOL_2] ...

6. get_company_profile.js

Get a comprehensive company profile, including description, industry, and CEO.

Syntax:

node scripts/get_company_profile.js <SYMBOL>

Important Guidelines

Cryptos: Use IDs | Stocks: Use Tickers

  • Cryptocurrencies: Always use Coin IDs (slugs) instead of ticker symbols (e.g., bitcoin, BTC).
  • Stocks: Always use Ticker Symbols (e.g., AAPL, Apple).

Use search_coins.js if you are unsure of the correct ID.

Authentication

Authentication is handled automatically by the internal api_client.js. Here is how it works simply:

  • Endpoint: GET https://api.igent.net/api/token
  • Mechanism:
    1. Automatic Retrieval: The first time you use a tool, it asks the server for a temporary session token.
    2. Local Storage: This token is stored in a hidden .token file locally so it can be reused for subsequent requests.
    3. Automatic Headers: The client automatically includes this token in every request to prove you are authorized.
    4. Auto-Refresh: If a token expires, the client automatically fetches a new one without you needing to do anything.

No manual API keys or configuration are required.

Rate Limiting

While the system is robust, please avoid burst requests (more than 30 per minute) to maintain service stability for all users.

Agent Integration

This skill is fully compatible with OpenClaw and other agents using the AgentSkills standard. Execute scripts directly from the scripts/ directory.

Files

16 total
Select a file
Select a file to preview.

Comments

Loading comments…