Crypto Funding Alert

PassAudited by ClawScan on May 1, 2026.

Overview

The artifacts show a coherent public Binance funding-rate scanner with disclosed local logging, optional alerts, and no credential use or trade execution.

This skill appears safe to install from the provided artifacts if you only want a public-data Binance funding scanner. Before using it, understand that it gives risky leveraged-trading suggestions, writes local history, and can be configured for recurring cron or external webhook alerts.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A user might make risky crypto futures trades based on the scanner output.

Why it was flagged

The skill frames scanner output as leveraged trading actions. This is disclosed and paired with a disclaimer, and the code does not execute trades, but users could over-trust the recommendation language.

Skill content
🏆 Recommended Actions: ... DOGE: Long 3x | Stop-loss 10% | Rate -0.0125% | Annual 41%
Recommendation

Treat the output as research only, verify independently, and do not allow any agent or separate tool to place trades without explicit review.

What this means

The skill will contact Binance and create or append a local scan_history.jsonl file containing market scan results and configuration values.

Why it was flagged

Running the scanner makes outbound requests to Binance and writes scan history to disk. These behaviors are expected for the stated scanner and historical tracking purpose.

Skill content
httpsGet(`https://fapi.binance.com/fapi/v1/premiumIndex?symbol=${coin}USDT`) ... fs.appendFileSync(logFile, JSON.stringify(record) + '\n');
Recommendation

Run it only if Binance API access and local logging are acceptable, and choose any custom output path carefully.

What this means

If the user enables this example, scan results and inferred trading interests may be sent to a third-party webhook.

Why it was flagged

The documentation includes an optional Discord webhook example that forwards the scanner output externally. This is user-directed and purpose-aligned for alerts.

Skill content
RESULT=$(node scan.js)
curl -X POST $DISCORD_WEBHOOK -H "Content-Type: application/json" -d "{\"content\":\"$RESULT\"}"
Recommendation

Use webhook or messaging integrations only with trusted destinations, and avoid including account-specific or sensitive information in alert output.

What this means

If configured, the scanner will keep running every four hours, making network requests and appending local history.

Why it was flagged

The skill documents an optional recurring cron setup. It is disclosed and user-directed, but it would continue running periodically until removed.

Skill content
openclaw cron add "0 */4 * * *" "cd ~/.openclaw/workspace/skills/crypto-funding-alert && node scan.js"
Recommendation

Only add the cron job if continuous monitoring is desired, and remove it when no longer needed.