Crypto Content Automation

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Running the skill may fail or execute unrelated local helper code that was not part of this review.

Why it was flagged

The runtime imports helper modules from a hard-coded workspace path outside the skill package; those helper files are not included in the provided manifest, so the executed code is not reviewable here.

Skill content

WORKSPACE = '/Users/youyou/.openclaw/workspace'
SCRIPTS_DIR = os.path.join(WORKSPACE, 'scripts')
sys.path.insert(0, SCRIPTS_DIR)
from hot_topic_scanner import scan_ai_news, scan_crypto_news, scan_ai_crypto

Recommendation

Bundle the helper scripts inside the skill, use relative imports, and avoid prepending broad workspace paths to Python's import search path.

Concern

ASI02: Tool Misuse and Exploitation

What this means

The agent could publish crypto-related content under the user's social account without clear review boundaries, creating reputational, compliance, or account-risk consequences.

Why it was flagged

The documented workflow includes one-command publishing to external platforms, but it does not require a visible final user approval or preview before posting generated content.

Skill content

加密货币自媒体运营自动化工具，一句话完成：热点扫描 → 内容策划 → 发布 ... 5. 发布到目标平台

Recommendation

Require an explicit per-post confirmation that shows the final content, target platform, account, and any attached media before publishing.

Concern

ASI03: Identity and Privilege Abuse

What this means

If real platform cookies are provided, the skill may have account-level authority to post or act as the user on those services.

Why it was flagged

Platform cookies are login/session credentials that can authorize actions as the user, but the registry declares no credentials and the artifacts do not specify cookie scope, storage location, or handling controls.

Skill content

支持发布到：
- 小红书（需要Cookie配置）
- 币安Square（需要Cookie配置）

Recommendation

Declare the credential requirement, prefer scoped official APIs or OAuth where possible, store secrets securely, and document exactly how cookies are used and protected.