Crypto Portfolio Tracker
v1.0.0加密貨幣Portfolio追蹤 - 支援TRON/ETH/BSC，分析持倉、收益、Gas費用
⭐ 0· 1.9k·18 current·18 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims TRON/ETH/BSC support, holdings/profits/gas analysis and price alerts, but the runtime instructions only show example commands for a 'tron' CLI. No guidance is provided for Ethereum/BSC (e.g., eth/bsc CLI, RPC endpoints, or explorer APIs). The declared metadata lists no required binaries or tools, yet the docs imply a dependency on a 'tron' command-line tool.
Instruction Scope
SKILL.md is short and instruction-only; it suggests running 'tron wallet --address ...' and 'tron token ...' commands but does not explain where that 'tron' binary comes from, what permissions/network access it needs, or how to configure RPC/API keys. There are no instructions that explicitly exfiltrate data, but the vagueness gives the agent broad discretion (e.g., to run shell commands) without declared constraints.
Install Mechanism
No install spec and no code files are provided (instruction-only), which means nothing is written to disk by the skill itself. This is the lowest-risk install model, but it relies on external tools being present when the agent runs commands.
Credentials
The skill requests no environment variables or credentials, which is consistent with the provided content. However, practical portfolio trackers usually require RPC endpoints, API keys, or explorer tokens for ETH/BSC/TRON — none are declared. This omission may be sloppy documentation or hide additional required configuration.
Persistence & Privilege
The skill does not request always=true and does not persist configuration. It is user-invocable and allows autonomous invocation (platform default). Those privileges are normal here and are not by themselves a concern.
What to consider before installing
This skill is inconsistent: it claims multi-chain functionality but only documents 'tron' CLI commands and declares no dependencies or credentials. Before installing or enabling it, ask the author to: (1) list required binaries and exact commands (e.g., tron/eth CLI tools), (2) describe how Ethereum/BSC support works (RPC endpoints, APIs, or explorer services), (3) declare any env vars or secrets it needs (RPC keys, API keys), and (4) provide a trusted source/homepage. Because the skill is instruction-only, the agent could attempt to run shell commands like 'tron ...' — run it in a sandbox or with limited permissions if you test it. If you don't get clear answers or a reputable source, treat it as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk970bvv6kb62egajqzdbww9vg181ek0w
License
MIT-0
Free to use, modify, and redistribute. No attribution required.