Price for Agent
v1.1.0Get real-time prices for crypto, stocks, and commodities. Use when the user asks about asset prices, market data, or needs to check the value of Bitcoin, Ethereum, stocks like NVDA/AAPL, or commodities like gold/silver. Supports natural language queries ("What's the price of Bitcoin?") and direct lookups.
⭐ 1· 1.7k·4 current·4 all-time
by@edibez
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (real-time prices for crypto, stocks, commodities) align with the SKILL.md instructions: curl calls to obtain prices, batch queries, and function schema. Nothing in the instructions claims unrelated capabilities.
Instruction Scope
The instructions direct the agent to make HTTP requests to a single external service (https://p4ai.bitharga.com) including a registration endpoint that issues API keys. The instructions do not ask the agent to read local files or unrelated environment variables, but they do involve sending user queries to an external, unfamiliar host (possible data exposure).
Install Mechanism
This is an instruction-only skill with no install spec and no code files — lowest install risk. Nothing is written to disk by the skill itself.
Credentials
The skill declares no required env vars or credentials, yet the documented workflow obtains and uses an API key (X-API-Key). This is plausible (agent can register to get a key), but there is a small mismatch between declared requirements and runtime behavior that the user should understand.
Persistence & Privilege
The skill does not request persistent presence (always: false) and does not ask to modify other skills or system-wide settings. It can be invoked by the agent but that is the platform default.
What to consider before installing
This skill appears to do what it says (fetch prices) but it relies on an unfamiliar external service (p4ai.bitharga.com) and the SKILL.md shows a registration flow that issues API keys even though no credentials are declared in the metadata. Before installing: 1) Verify the service and domain (search for company info, docs, reputation). 2) If you must use it, avoid sending sensitive or identifying information in queries; treat the API key as a secret and rotate/revoke it if needed. 3) Prefer well-known market-data providers when possible. 4) Ask the publisher for a privacy/security policy or an OpenAPI file (the skill references /v1/openapi.yaml) and confirm how long keys last and what data is logged. 5) Note the small metadata mismatches (version/published timestamps) — consider that a sign to proceed cautiously or require more provenance before trusting the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk97fgw66q2vpt3dck8w5fyvx6h80qpwk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.