Crypto Price

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

When invoked, the agent may run the included script and attach a generated chart image.

Why it was flagged

The skill instructs the agent to execute a local bundled Python script with a user-selected token and duration; this is necessary for the stated charting function and is clearly disclosed.

Skill content
python3 {baseDir}/scripts/get_price_chart.py <SYMBOL> [duration]
Recommendation

Use the skill when you are comfortable with local script execution for crypto chart generation, and review output before relying on it.

What this means

Installing dependencies may pull the current compatible matplotlib release and its transitive dependencies.

Why it was flagged

The charting dependency is declared with a lower-bound version rather than an exact pin; this is purpose-aligned but leaves package resolution to the user environment.

Skill content
matplotlib>=3.5.0
Recommendation

Install dependencies from a trusted package index, preferably in a virtual environment; pin versions if you need reproducible installs.

What this means

Token symbols and requested timeframes may be sent to CoinGecko or Hyperliquid.

Why it was flagged

The skill sends market-data requests to named third-party APIs; this is disclosed and central to the price lookup purpose, with no credentials or private local data shown.

Skill content
Hyperliquid API - For HYPE and other Hyperliquid tokens (preferred) ... CoinGecko API - Fallback for other tokens
Recommendation

Avoid treating queried symbols or timing as private, and independently verify prices before making financial decisions.

What this means

Repeated requests may return recently cached public market data rather than freshly fetched data.

Why it was flagged

The skill temporarily reuses cached public price data; this is disclosed and short-lived, but users should know results may come from cache.

Skill content
Price data cached for 300 seconds (5 minutes) in `/tmp/crypto_price_*.json`.
Recommendation

If freshness matters, wait for cache expiry or clear the relevant /tmp cache files before retrying.