Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Crypto Analyst
v1.1.1加密货币综合分析工具，整合OKX、Binance双交易所数据。提供行情查询、技术分析、交易信号、资金流向、仓位管理、DCA计划、风险计算。触发词：分析BTC、行情查询、交易信号、仓位计算、DCA计划、巨鲸追踪、风险评估。
⭐ 0· 103·0 current·0 all-time
byYirong@erongcao
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description promise: OKX+Binance analysis, signals, DCA, position sizing. The shipped scripts implement those features (okx_analyst.py, binance_market.py, dca_calculator.py, position_sizer.py, etc.). Requiring OKX API credentials for balance/OKX private endpoints aligns with the stated features. However, repository metadata in _meta.json (ownerId, slug, version) does not match the registry metadata provided, which is an inconsistency in packaging/source provenance that reduces trust.
Instruction Scope
SKILL.md instructs the agent to run contained Python scripts and to place OKX credentials in a .env. The scripts read .env (project root or script dir) and use network APIs (OKX, Binance, alternative.me, ns3.ai) consistent with the stated purpose. No instructions ask the agent to read unrelated system files. Minor issue: SKILL.md references copying .env.example to .env, but no .env.example is present in the file manifest—so the user must create the .env manually. Also several scripts were truncated in the provided listing; those omitted files should be reviewed before trusting the package.
Install Mechanism
No installation spec is provided (instruction-only install), and the SKILL.md lists reasonable Python dependencies (requests, pandas, numpy, python-dotenv, akshare). There are no remote downloads or archive extraction steps in the manifest, which lowers install-time risk.
Credentials
Only exchange credentials (OKX API key, secret, passphrase) are needed for the OKX-only features; no unrelated credentials are requested. The scripts load .env files into environment variables at runtime — this is expected for API keys but means plaintext secrets in a project .env file could be read by the scripts. The code accesses only those env vars declared in SKILL.md and the scripts; I did not find requests for unrelated secrets in the visible files.
Persistence & Privilege
Flags show always:false and normal autonomous invocation allowed. The package does not request persistent system-wide privileges or attempt to modify other skills; it is a normal, on-demand toolset.
What to consider before installing
What to check before installing or running:
- Provenance: _meta.json (owner, slug, version) does not match the registry metadata shown — confirm the publisher/source before trusting code that handles API keys.
- Secrets: The tools ask you to store OKX API_KEY/SECRET/PASSPHRASE in a .env file which the scripts will load. Only provide keys with the minimum permissions needed (read-only where possible) and avoid putting long-term trading keys into this directory unless you trust the source.
- Missing files: SKILL.md suggests a .env.example but none is in the manifest; create .env carefully and verify names match the scripts (OKX_API_KEY, OKX_API_SECRET, OKX_API_PASSPHRASE).
- External endpoints: The analyzer fetches news from a third-party NS3 endpoint (api.ns3.ai) and alternative.me for Fear & Greed; confirm you are comfortable with those telemetry/requests and that no other unknown remote endpoints exist in the omitted files.
- Code review: A few scripts were truncated in the provided listing. If you will run these tools with real account credentials, review the remaining files (whale_tracker.py, technical_analysis.py or any omitted files) for any unexpected behavior (credential transmission to unknown servers, hidden POST/PUT calls, or file writes). If you lack the ability to audit, prefer using read-only API keys or running the scripts in an isolated environment.
- Operational precaution: Run first with no credentials (or read-only keys) to verify behavior, and consider running inside a disposable container or VM. If you need higher assurance, ask the publisher for a signed release or review the full source history.Like a lobster shell, security has layers — review code before you run it.
latestvk973n6cm36x2a5hcxx96kptj5d84g8yh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.