Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill suspicious because scanners report account login and publishing activity beyond its stated crypto-alert purpose, alongside an alert accuracy issue; the evidence is incomplete because a referenced local path was missing.
Consider avoiding installation until the publisher explains why the skill logs into ClawHub and publishes a skill, clarifies its permissions and command scope, and addresses the alert-price issue. Review is incomplete: one referenced local path was missing, and the clean AIG result does not resolve the concerns reported by Skillspector.
The supplied commands perform skill installation and publication workflow steps rather than crypto-alert management. CLI installation could be a supporting detail, but account login and skill publication are distinct operations not disclosed by the declared purpose. No implementation of the declared alert behaviors appears in the supplied chunk.
Without declared permissions the skill's intent is opaque and cannot be validated.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
REMIND_WINDOW = 6 * 3600
TOP_N = 50
API = ("https://api.coingecko.com/api/v3/coins/markets?vs_currency=usd"
"&order=market_cap_desc&per_page={n}&page=1")
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if not ids:
return {}
url = API.format(n=TOP_N) if len(ids) >= TOP_N else (
"https://api.coingecko.com/api/v3/simple/price?ids="
+ urllib.parse.quote(",".join(ids)) + "&vs_currencies=usd")
try:
with urllib.request.urlopen(url, timeout=15) as r:
The entry-touch test uses the minimum and maximum of entry, TP, and CL, so nearly the entire trade range qualifies instead of the configured entry tolerance. This undermines alert integrity and can prompt a user to enter a leveraged trade far from their intended price; the impact is limited by the absence of automatic order execution.
The usage instructions present common standalone phrases such as pasang, batal, and list as commands in ordinary agent chat. Although some commands identify their applicable setup stage, the README does not explicitly restrict these phrases to an active crypto-alerts interaction or exclude unrelated conversations.