Solana Monitor Pro

This package implements exactly the monitoring features it claims, but there are notable inconsistencies you should address before trusting it with secrets: - The metadata declares no required credentials, yet the README/SKILL.md ask you to provide TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID and SMTP credentials. Those are reasonable for notifications but the mismatch means the registry won't warn you about the required secrets. Treat those as mandatory sensitive inputs. - The code never imports dotenv or a YAML parser, but documentation instructs creating .env or config/config.yaml. That means the scripts expect credentials to be passed programmatically (e.g., NotificationManager.setup_telegram(...)) and will not automatically read the files described. Don't assume placing secrets into config/config.yaml will be used. - requirements.txt lists python-dotenv but the code doesn't use it; this is an indicator of sloppy packaging. Also README references an HTTP API (localhost:8000) and API endpoints that are not in the repository — another mismatch. - The external network endpoints contacted are public and expected for this purpose: CoinGecko (https://api.coingecko.com), Solana RPC (https://api.mainnet-beta.solana.com) and Telegram API. The code does not include any obfuscated URLs or unexpected remote download behavior. Recommendations before installing/using: - Inspect and run the code in an isolated environment (container or VM). - Do not paste credentials into global files until you confirm the code reads them where you place them. Prefer creating and passing credentials at runtime, or modify the code to load .env/config securely. - Replace the public SMTP password with an app-specific credential and restrict mailbox access; prefer a dedicated notification account. - Verify the author/source (registry owner is not a known vendor and homepage is missing). If you need guarantees, request provenance or a signed release. - If you plan to allow autonomous agent invocation with this skill, be aware the agent could use configured notification channels to exfiltrate data (e.g., send messages/emails). Ensure notification channels are dedicated and monitored. Given the coherence of functionality but multiple mismatches and packaging sloppiness, the package is suspicious rather than clearly benign. If you want a clean setup, ask the maintainer for clarified config-loading behavior and a minimal, accurate requirements file.