Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

BTC短线预测

v1.0.0

BTC 15分钟短线预测 - 技术指标分析,预测涨跌方向。每次调用0.005 USDT。

0· 341·1 current·1 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the implementation: code fetches Binance public market data and computes RSI/MACD/Bollinger signals to produce 15-minute predictions. Requesting SKILLPAY_API_KEY is coherent with the described per-call charge. However, the code includes a fallback to a hard-coded billing API key, which is unexpected for a billing-integrated skill and contradicts the declared requirement (SKILLPAY_API_KEY).
Instruction Scope
Runtime instructions (SKILL.md) simply run the provided node script(s). The scripts only access network endpoints (api.binance.com and skillpay.me) and environment variables. They do not read arbitrary local files or unrelated system configuration. SKILL.md does not mention the optional SKILLPAY_DEV flag observed in code.
Install Mechanism
No install spec; this is instruction-and-code packaged as-is. No external installers or downloads are used. The risk surface is limited to the included JS files running under Node.
!
Credentials
The skill declares one required env var (SKILLPAY_API_KEY), which is appropriate for billing. BUT skillpay.js falls back to a hard-coded API key when the env var is absent, and also checks SKILLPAY_DEV without documenting it. Hard-coded credentials in source are a security and provenance concern: they may be a shared/test key or an attempt to route payments through the maintainer's account. This is disproportionate and inconsistent with the declared requirement.
Persistence & Privilege
The skill does not request elevated platform privileges, does not set always:true, and does not modify other skills or system-wide configs. It runs on demand and does not persist credentials beyond using environment variables.
What to consider before installing
This skill appears to do what it says (fetch Binance data and produce short-term BTC predictions) and enforces a small per-call charge via an external billing API. However: (1) the code contains a hard-coded SkillPay API key fallback — this is unexpected and risky because it means the skill will call an external billing service even if you don't provide your own key, and payments/requests could be routed through the author's account; (2) the SKILL.md doesn't document the SKILLPAY_DEV flag observed in the code; (3) the skill's source and homepage are unknown, so provenance is limited. Before installing: verify the SkillPay endpoint (https://skillpay.me) and the legitimacy of the hard-coded key with the author or by checking a trusted source; prefer to set your own SKILLPAY_API_KEY rather than relying on the fallback; consider running the code in a sandboxed environment and/or setting SKILLPAY_DEV=true to avoid real charges while testing; if you plan to use it in production, review or remove the hard-coded key and confirm billing behavior and refund/payment terms. If you need higher assurance, ask the publisher for provenance (homepage, contact) or for the key to be removed/fixed.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

EnvSKILLPAY_API_KEY
latestvk977ssf930dm7546eh8b51vcdx82a3s7
341downloads
0stars
1versions
Updated 8h ago
v1.0.0
MIT-0

BTC 短线预测器

高频交易神器 - 15分钟级别BTC涨跌预测

战绩参考

  • 胜率:91% (10胜1负)
  • 日盈利:~900美元
  • 频率:高频(15分钟级别)
  • 模式:全自动运行

收费模式

每次调用 0.005 USDT(约0.035元人民币)

使用方法

# 获取当前预测
node scripts/predict.js

# 查看历史战绩
node scripts/predict.js history

# 自动模式(每15分钟预测一次)
node scripts/predict.js auto

预测模型

基于技术指标组合:

  • RSI(相对强弱指数)
  • MACD(异同移动平均线)
  • 布林带
  • 成交量变化
  • 价格动量

输出示例

════════════════════════════════════════════════════
📊 BTC 15分钟预测
════════════════════════════════════════════════════

当前价格: $67,432.50
预测时间: 14:15 - 14:30

🎯 预测: 涨 📈
置信度: 78%

技术指标:
  RSI(14): 62.3 → 看涨
  MACD: 金叉形成 → 看涨
  布林带: 价格触及下轨 → 反弹信号
  成交量: 增加15% → 买盘增强

建议: BUY YES
止损: $67,200
止盈: $67,800

════════════════════════════════════════════════════

SkillPay 配置

环境变量:

  • SKILLPAY_API_KEY - SkillPay API密钥

Comments

Loading comments...