AVE Cloud Skill

v1.2.0

Query on-chain crypto data via the AVE Cloud API (https://cloud.ave.ai/). Use this skill whenever the user wants to: - Search for tokens by name, symbol, or...

2· 461·0 current·0 all-time
byAve@hope-ave
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's name, description, and required env vars (AVE_API_KEY, API_PLAN) align with an on-chain data client. However, the code frequently invokes Docker (docker inspect, docker exec, docker logs) and expects a server container and FIFO, yet the registry 'required binaries' only lists python3. Docker usage is central to some features (WSS/pro plan server) but not declared as a required binary—this is an incoherence the author should justify or fix.
!
Instruction Scope
SKILL.md repeatedly instructs running scripts/ave_client.py, but the repository contains scripts named ave_data_rest.py and ave_data_wss.py (no ave_client.py). The runtime instructions therefore reference a non-existent file, which is a functional inconsistency. The scripts also create /tmp FIFOs, read/write /tmp/ave_client_last_request, and use docker exec to interact with a container named 'ave-cloud-server'—behavior beyond simple HTTP calls and worth highlighting.
Install Mechanism
This is instruction-only (no formal install spec), which limits disk-writing risk. A Dockerfile is included (uses python:3.13-slim and pip install -r scripts/requirements.txt) and requirements.txt pins requests, requests-ratelimiter, and websocket-client. No external arbitrary downloads or URL shorteners are used. Still, the presence of a Dockerfile plus runtime docker exec expectations increases operational surface compared to a pure-CLI script.
Credentials
Requested environment variables (AVE_API_KEY and API_PLAN) match the described API usage and authentication model. The scripts also consult AVE_USE_DOCKER and AVE_IN_SERVER for runtime modes; those are reasonable but should be documented in the registry's required binaries list if Docker is expected for full functionality.
Persistence & Privilege
The skill does not request 'always: true'. However, runtime behavior can create /tmp/ave_client_last_request and /tmp/ave_pipe and expects/controls a Docker container named 'ave-cloud-server' (exec/logs). Those actions require Docker and filesystem write access to /tmp; they don't by themselves indicate privilege escalation but do increase the operational privileges needed and potential impact if the container environment is misused.
What to consider before installing
Things to check before installing or running this skill: - Confirm the missing/incorrect filenames: SKILL.md refers to scripts/ave_client.py but the package contains ave_data_rest.py and ave_data_wss.py. Ask the publisher to confirm the correct entrypoint or update SKILL.md. - Docker is used extensively (docker inspect/exec/logs and a Dockerfile) but 'docker' is not listed as a required binary. If you do not want the agent to run Docker, do not set AVE_USE_DOCKER=true and avoid pro/WSS server features; otherwise ensure Docker is available and you trust the image/container operations. - The scripts create/modify /tmp/ave_client_last_request and a FIFO (/tmp/ave_pipe) and will attempt to exec into a container named 'ave-cloud-server'. Make sure those filesystem and Docker operations are acceptable in your environment to avoid accidental interference with other containers or files. - The network endpoints (https://data.ave-api.xyz and wss://wss.ave-api.xyz) appear consistent with the stated purpose; only provide AVE_API_KEY to code you trust. Treat API keys as sensitive—if you don't trust the skill source, don't supply the key. - There are a few minor code issues visible (truncated/typo in code fragments and an apparent incomplete variable reference in the WSS server handler). Ask for a clean, complete release and a short changelog or author response addressing the above inconsistencies. If you want to proceed: request an updated skill package that (1) fixes/clarifies the script names and entrypoint used by SKILL.md, (2) lists docker as a required binary if Docker is necessary for advertised features, and (3) documents exactly which runtime modes create FIFOs or run docker exec so you can review/limit those operations.

Like a lobster shell, security has layers — review code before you run it.

latestvk970jbmy2fe12z7m6psng28k8d826fzr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

Binspython3
EnvAVE_API_KEY, API_PLAN
Primary envAVE_API_KEY

Comments