Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Crypto Arbitrage
v1.0.1Real-time cryptocurrency arbitrage scanner across multiple exchanges. Detect price discrepancies, calculate profitable opportunities, and execute arbitrage t...
⭐ 0· 70·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The description and SKILL.md promise real-time WebSocket feeds, 20+ exchange support, and auto-execution. The shipped package.json has no dependencies (no ccxt, no exchange SDKs, no websocket/net libs) and the visible index.js uses simulated prices and internal maps rather than making external API/WebSocket calls. This is a clear mismatch between claimed capabilities and implemented code.
Instruction Scope
Runtime instructions explicitly ask the user to add exchange API keys/secrets and to enable auto-execution. Those instructions imply network interaction and placing orders, but the code fragments provided simulate trading rather than showing actual exchange integrations. The SKILL.md also references contacting via external messaging for paid services (WeChat/Telegram) which is unrelated to runtime behavior but not itself harmful; still, asking for API keys in instructions while metadata declares none is a scope inconsistency.
Install Mechanism
There is no install script that downloads arbitrary code from unknown hosts; the skill is instruction/code-bundled and would be installed normally. No high-risk external download URLs or extract steps were present.
Credentials
The code uses process.env.ARBITRAGE_API_KEY as a fallback and the SKILL.md instructs adding exchange API keys/secrets at runtime, yet the registry lists no required env vars or primary credential. Asking users to supply API keys/secrets (which could grant trading/withdrawal access) is expected for this domain, but the lack of declared env requirements and the mismatch with implemented code is misleading and potentially dangerous if users hand over sensitive keys.
Persistence & Privilege
always is false (good). The skill supports auto-execution — and agents are allowed to invoke skills autonomously by default. That combination increases blast radius if the skill actually performs trades. This is not automatically disqualifying but worth caution: auto-execution plus provided API keys could allow real trades.
What to consider before installing
There are several red flags you should consider before installing or providing credentials: 1) The README and SKILL.md promise live, multi-exchange trading and auto-execution, but package.json declares no networking/trading dependencies and the visible code simulates prices — the implemented behavior may not match the claims. 2) The skill asks you (in docs) to add exchange API keys/secrets, yet the registry metadata lists no required env vars; do NOT provide API keys with withdrawal permissions. 3) If you still want to test it, run the package in an isolated sandbox, inspect the full index.js for any network calls (axios/fetch/websocket/ccxt/REST clients) and any code that performs HTTP POSTs to unexpected endpoints. 4) Use API keys with minimal permissions (enable trading only if needed, disable withdrawals, set IP restrictions), start with tiny funds or a sandbox/testnet account, and enable exchange-based 2FA and whitelisting. 5) Prefer to request the maintainer source verification or use a reputable, reviewed implementation — given the mismatch between claims and code, treat this package as potentially incomplete or misleading until you can verify the actual exchange integration.index.js:18
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk970x63znc1w235spnqc4w5mzh83hkpn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔄 Clawdis