Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Crypto Scope

v1.0.5

提供加密货币实时价格查询、技术指标分析(MA/RSI/MACD)和交易信号生成,支持多币种批量监控。

0· 412·3 current·3 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
Name/description promise basic crypto data and indicators (CoinGecko). The repository also contains explicit payment/billing integration (SkillPay) and scripts to configure/enable a paid edition. That extra capability can be legitimate, but the skill metadata declares no required credentials or primary credential while the code embeds SkillPay API keys and Skill IDs — a clear mismatch.
!
Instruction Scope
SKILL.md instructs running the included Python scripts (expected). However the shipped helper scripts (auto_setup.sh, configure_skillpay.sh, setup_skillpay.sh) will edit files in ~/.openclaw/workspace, replace Skill IDs inside scripts, run npx clawhub publish, and call SkillPay billing endpoints. Those setup/publish steps have side effects (filesystem changes, network calls, and publishing) beyond a simple analysis tool and are not documented as requiring credentials. They also rely on a hardcoded API key in the code.
Install Mechanism
There is no formal install spec (instruction-only), which reduces automatic install risk. The included scripts do call external tools (npx clawhub publish) and make outbound HTTP requests. No arbitrary binary downloads or extract-from-unknown-URL steps were found, but publishing via npx will reach the network and may install packages at runtime.
!
Credentials
Registry metadata declares no required env vars, yet crypto_analyzer.py and paid variants reference SKILLPAY_API_KEY and include a default API key string. Multiple files also include a hardcoded BILLING_API_KEY/SKILL_ID. Requesting or embedding a billing API key (and using it by default) is disproportionate and inconsistent with declared requirements and with a free CoinGecko-based analyzer.
Persistence & Privilege
The skill is not always:true and does not request elevated agent privileges. However the setup scripts will modify files under the user's ~/.openclaw/workspace and invoke publish commands — i.e., they change the user's skill workspace and may publish changes to ClawHub. This is normal for an authoring/publishing workflow but is a persistent action the user should consent to.
Scan Findings in Context
[HARD_CODED_API_KEY] unexpected: Multiple files contain an apparent SkillPay API key/default (e.g. 'sk_0de94ea9...') and default billing key constants. Embedding active API keys is not expected for a public skill and is inconsistent with metadata that declares no required credentials.
[HARDCODED_SKILL_ID] unexpected: Files include hardcoded SkillPay Skill IDs (e.g. '0c9fb051-...') and scripts that replace those IDs. Shipping concrete IDs and automatic replace/publish scripts increases the chance of accidental use of developer/test credentials or leaking identifiers.
What to consider before installing
This skill appears to implement the claimed crypto analysis features, but there are red flags you should address before running anything: (1) The package embeds SkillPay billing API keys and Skill IDs in multiple scripts—do NOT run setup or paid scripts unless you trust the key owner and understand the billing flow. Replace or remove any hardcoded keys and set proper environment variables (e.g., SKILLPAY_API_KEY) instead. (2) The included setup scripts will edit files in ~/.openclaw/workspace and call 'npx clawhub publish'—review those commands and their effects, and run them only from a controlled environment or a clone. (3) If you intend to use the paid functionality, create your own SkillPay credentials and update the scripts rather than using the bundled defaults; rotate keys if you accidentally used them. (4) Audit network endpoints (https://skillpay.me and CoinGecko) and confirm they are legitimate for your use. If you want, provide the exact lines with the API key/published SKILL_ID you see and I can point out where to change them and what safer defaults to use.

Like a lobster shell, security has layers — review code before you run it.

latestvk97babfcyw74kk21sx6cwrckx582gkw8
412downloads
0stars
6versions
Updated 6h ago
v1.0.5
MIT-0

CryptoScope - 加密货币数据分析助手

快速开始

实时价格查询

# 比特币价格
python3 scripts/crypto_analyzer.py price bitcoin

# 以太坊价格
python3 scripts/crypto_analyzer.py price ethereum

# 自定义币种
python3 scripts/crypto_analyzer.py price solana

技术指标分析

# 完整技术分析
python3 scripts/crypto_analyzer.py analyze bitcoin

# 指定指标
python3 scripts/crypto_analyzer.py analyze ethereum --indicators ma,rsi,macd

交易信号

# 生成交易信号
python3 scripts/crypto_analyzer.py signal bitcoin

# 多币种信号
python3 scripts/crypto_analyzer.py signal bitcoin,ethereum,solana

输出格式

JSON格式(默认)

{
  "symbol": "bitcoin",
  "name": "Bitcoin",
  "price": 42350.67,
  "change_24h": 2.35,
  "volume_24h": 28500000000,
  "market_cap": 830000000000,
  "indicators": {
    "ma_20": 42100.50,
    "rsi": 58.3,
    "macd": "bullish"
  },
  "signal": "BUY",
  "confidence": 0.75,
  "timestamp": 1709798400
}

Markdown格式

python3 scripts/crypto_analyzer.py analyze bitcoin --format markdown

核心功能

1. 实时价格查询

支持币种:

  • ✅ Bitcoin (BTC)
  • ✅ Ethereum (ETH)
  • ✅ BNB (BNB)
  • ✅ Solana (SOL)
  • ✅ Cardano (ADA)
  • ✅ Polkadot (DOT)
  • ✅ 10000+ 其他币种

数据来源:

  • CoinGecko API(免费)
  • 更新频率:每分钟

示例:

python3 scripts/crypto_analyzer.py price bitcoin

# 输出
{
  "symbol": "bitcoin",
  "name": "Bitcoin",
  "price": 42350.67,
  "change_24h": 2.35,
  "volume_24h": 28500000000
}

2. 技术指标分析

支持指标:

指标说明周期
MA移动平均线20/50/200
RSI相对强弱指数14
MACD异同移动平均线12/26/9
Bollinger布林带20,2
EMA指数移动平均12/26

示例:

# 完整分析
python3 scripts/crypto_analyzer.py analyze ethereum

# 输出
{
  "symbol": "ethereum",
  "price": 2250.45,
  "indicators": {
    "ma_20": 2200.30,
    "ma_50": 2150.80,
    "rsi": 62.5,
    "macd": {
      "value": 15.3,
      "signal": 12.1,
      "trend": "bullish"
    }
  }
}

3. 交易信号生成

信号类型:

  • BUY(买入)
  • SELL(卖出)
  • HOLD(持有)

信号逻辑:

# 多指标综合判断
- MA交叉
- RSI超买超卖
- MACD金叉死叉
- 趋势强度

# 置信度计算
confidence = (
    ma_signal * 0.3 +
    rsi_signal * 0.3 +
    macd_signal * 0.4
)

示例:

python3 scripts/crypto_analyzer.py signal bitcoin

# 输出
{
  "symbol": "bitcoin",
  "signal": "BUY",
  "confidence": 0.75,
  "reasons": [
    "MA20上穿MA50",
    "RSI=58(健康区间)",
    "MACD金叉确认"
  ],
  "risk_level": "medium"
}

4. 批量监控

多币种监控:

# 监控多个币种
python3 scripts/crypto_analyzer.py monitor bitcoin,ethereum,solana

# 输出
[
  {
    "symbol": "bitcoin",
    "price": 42350.67,
    "signal": "BUY",
    "confidence": 0.75
  },
  {
    "symbol": "ethereum",
    "price": 2250.45,
    "signal": "HOLD",
    "confidence": 0.60
  },
  {
    "symbol": "solana",
    "price": 105.30,
    "signal": "SELL",
    "confidence": 0.70
  }
]

高级用法

自定义周期

# 指定MA周期
python3 scripts/crypto_analyzer.py analyze bitcoin --ma-periods 10,30,60

# 指定RSI周期
python3 scripts/crypto_analyzer.py analyze ethereum --rsi-period 21

历史数据

# 获取历史价格
python3 scripts/crypto_analyzer.py history bitcoin --days 30

# 导出CSV
python3 scripts/crypto_analyzer.py history ethereum --days 90 --output csv

预警设置

# 设置价格预警
python3 scripts/crypto_analyzer.py alert bitcoin --above 45000

# RSI预警
python3 scripts/crypto_analyzer.py alert ethereum --rsi-below 30

技术细节

数据来源

CoinGecko API:

  • 免费额度:50次/分钟
  • 支持币种:10000+
  • 数据更新:实时

降级策略:

  • CoinGecko失败 → CoinCap API
  • 全失败 → 返回缓存数据

指标计算

移动平均线(MA):

def calculate_ma(prices, period):
    return sum(prices[-period:]) / period

相对强弱指数(RSI):

def calculate_rsi(prices, period=14):
    gains = [max(prices[i] - prices[i-1], 0) for i in range(1, len(prices))]
    losses = [max(prices[i-1] - prices[i], 0) for i in range(1, len(prices))]
    
    avg_gain = sum(gains[-period:]) / period
    avg_loss = sum(losses[-period:]) / period
    
    if avg_loss == 0:
        return 100
    
    rs = avg_gain / avg_loss
    return 100 - (100 / (1 + rs))

MACD:

def calculate_macd(prices):
    ema_12 = calculate_ema(prices, 12)
    ema_26 = calculate_ema(prices, 26)
    
    macd = ema_12 - ema_26
    signal = calculate_ema([macd], 9)
    
    return {
        "macd": macd,
        "signal": signal,
        "histogram": macd - signal
    }

信号逻辑

买入信号:

  1. MA20上穿MA50
  2. RSI < 70(未超买)
  3. MACD金叉

卖出信号:

  1. MA20下穿MA50
  2. RSI > 30(未超卖)
  3. MACD死叉

持有信号:

  • 其他情况

错误处理

常见错误

错误原因解决方案
APIErrorCoinGecko API限制等待1分钟后重试
InvalidSymbol币种不支持检查币种名称
InsufficientData数据不足至少需要30天数据

日志级别

# 调试模式
python3 scripts/crypto_analyzer.py analyze bitcoin --log-level debug

最佳实践

1. 数据缓存

# 启用缓存(默认5分钟)
python3 scripts/crypto_analyzer.py price bitcoin --cache 300

2. 批量请求

# 批量查询(减少API调用)
python3 scripts/crypto_analyzer.py monitor bitcoin,ethereum,solana

3. 风险管理

⚠️ 免责声明:

  • 信号仅供参考,不构成投资建议
  • 加密货币市场风险极高
  • 请根据自身情况谨慎决策

使用场景

1. 日常监控

  • 每日查看持仓币种信号
  • 追踪市场趋势
  • 调整投资策略

2. 交易决策

  • 辅助判断买卖时机
  • 验证交易想法
  • 风险评估

3. 研究分析

  • 对比不同币种
  • 回测交易策略
  • 学习技术分析

与其他技能配合

Doc Genius(文档分析)

# 分析白皮书 → 技术分析
python3 doc-genius/scripts/doc_processor.py summarize whitepaper.pdf
python3 crypto-scope/scripts/crypto_analyzer.py analyze bitcoin

Scrapling Fetch(数据抓取)

# 抓取新闻 → 情绪分析
python3 scrapling-fetch/scripts/fetch.py "https://cryptonews.com"
python3 crypto-scope/scripts/crypto_analyzer.py sentiment bitcoin

更新日志

v1.0.0 (2026-03-07)

  • ✅ 初始发布
  • ✅ 实时价格查询
  • ✅ 技术指标分析
  • ✅ 交易信号生成

反馈与支持


CryptoScope - 让加密货币分析更智能 📈💰


💰 付费版本

安装

npx clawhub install crypto-scope

使用

# 实时价格($0.05/次)
python3 scripts/crypto_analyzer_paid.py price bitcoin --user-id user123

# 技术分析($0.05/次)
python3 scripts/crypto_analyzer_paid.py analyze ethereum --user-id user123

# 交易信号($0.05/次)
python3 scripts/crypto_analyzer_paid.py signal solana --user-id user123

计费说明

  • 定价: $0.05 USDT / 次
  • 支付: BNB Chain USDT
  • 最低充值: $8 USDT
  • 平台费用: 5%

扣费流程:

  1. 检查余额
  2. 获取数据
  3. 自动扣费
  4. 返回结果

余额不足时: 自动返回充值链接


🔧 配置

SkillPay配置

步骤:

  1. 登录 https://skillpay.me
  2. 创建新技能
  3. 复制Skill ID
  4. 更新脚本中的 SKILL_ID
# 在 crypto_analyzer_paid.py 中修改
SKILL_ID = 'your-skill-id-here'  # 替换为真实Skill ID

📊 商业化

预期收益:

  • 日调用量:20次
  • 日收入:$1.00
  • 月收入:$30

目标用户:

  • 加密货币交易者
  • 区块链开发者
  • Web3投资者

Comments

Loading comments...