Crypto Market Monitor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:47 AM UTC
• Version: 2.0.0

Overview

The skill appears intended for crypto and economic monitoring, but it has under-disclosed financial-data accuracy problems and unsafe hard-coded root/import behavior that users should review carefully.

Review this skill before installing. It fetches public crypto prices, writes local JSON data, and can be scheduled with cron, but parts of the economic calendar are generated rather than live and the scripts contain hard-coded /root paths that may fail or tempt root execution. Install only in an isolated environment, avoid sudo, do not enable cron until paths and imports are fixed, and do not rely on its economic calendar for trading decisions without independent verification.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: INSTALL.md:96

Finding

Unpinned and Unnecessary Runtime Dependencies Increase Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

pytz== ``` 3. Generate and verify cryptographic hashes for every direct and transitive dependency, then install with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Require installation in a project-specific virtual environment: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 5. Document that dependency installation must not be performed as root. 6. Add automated dependency auditing and update pinned versions only after review and testing. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/crypto_monitor_telegram.py:8

Finding

Hard-Coded Root Workspace and Import Paths Create Unsafe Module Resolution and Encourage Excessive Privilege

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documentation claims comprehensive market monitoring, alerting, sentiment analysis, and external data retrieval, but the underlying behavior reportedly does not implement those functions. This is dangerous because users may make financial or operational decisions based on false assumptions about live monitoring, alert coverage, or data freshness, creating a trust and integrity failure rather than a direct code-execution issue.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The example directly instructs deletion of a file via shell command, which is a form of tool misuse risk because users may execute it without understanding permanence or adapting it safely to their environment. Although the path is relatively scoped (data/actual_data.json), documentation that encourages copy-paste destructive commands increases the chance of accidental or repeated data loss.

Content

Scanner excerpt · references/usage-examples.md (reported line 263)May include surrounding context.

Q: How to clear all data? A: Delete data file:

bash

rm data/actual_data.json

Best Practices

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 12)May include surrounding context.

md

# Or manually extract to workspace
unzip crypto-market.skill -d ~/.openclaw/workspace/skills/

# 2. Create required directories
mkdir -p ~/.openclaw/workspace/crypto/{economic,scripts,data,logs}

# 3. Copy skill files to crypto workspace

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The installation instructions explicitly direct the user to add cron jobs that execute the skill's Python scripts on a recurring basis. Even if presented as legitimate monitoring automation, this establishes persistence and repeated code execution, which increases risk because any compromised or later-modified script will continue running unattended.

Content

Scanner excerpt · INSTALL.md (reported line 87)May include surrounding context.

bash

# Edit crontab
crontab -e

# Add these lines (adjust paths if needed):
0 8 * * * cd ~/.openclaw/workspace/crypto/economic && /usr/bin/python3 daily_economic_report_v2.py >> ~/.openclaw/workspace/crypto/logs/economic_report.log 2>&1

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · INSTALL.md (reported line 122)May include surrounding context.

md

### Path errors
- Ensure all directories exist: `mkdir -p ~/.openclaw/workspace/crypto/{economic,scripts,data,logs}`
- Check file permissions: `ls -l ~/.openclaw/workspace/crypto/`
- Verify Python path: `which python3`

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence

Finding

The skill documentation describes capabilities that imply file read/write and network access, but it does not declare any explicit tool scope or permissions. This weakens least-privilege boundaries and can mislead users or agents about what the skill may access, increasing the chance of unintended data exposure or unauthorized external communication when the referenced scripts are run.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The note states that all times are Asia/Shanghai (Beijing Time), which imposes a specific locale on users in natural-language documentation. The file does not offer an opt-in, conversion guidance, or explain that the skill is intentionally limited to a China-specific audience, so this appears to violate the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users to run a destructive deletion command (rm data/actual_data.json) with no warning, confirmation step, backup guidance, or safer alternative. In a skill context, users may copy-paste commands directly, so this creates a real risk of accidental data loss even if it is not arbitrary code execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s top-level description and all user-facing output strings are explicitly in Chinese, indicating the skill is designed to operate in a single language. The policy requires flagging language or locale constraints when the skill does not offer user opt-in or a documented justification for the restriction.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script prepends a hard-coded external workspace path to sys.path and then imports Python modules from there, causing execution to depend on code outside the skill package. If that workspace path is modified by another process or user, the script will import and execute attacker-controlled code with the script's privileges, which is a classic arbitrary code execution risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto_monitor_telegram.py (reported line 45)May include surrounding context.

python

def get_crypto_prices():
    """获取加密货币价格数据（包含 sparkline 数据用于计算 EMA）"""
    ids = ','.join(TOKENS.values())
    url = f'https://api.coingecko.com/api/v3/coins/markets?vs_currency=usd&ids={ids}&order=market_cap_desc&sparkline=true&price_change_percentage=1h,24h,7d,30d'

    # 尝试 CoinGecko API（最多重试 2 次）
    for attempt in range(3):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto_monitor_telegram.py (reported line 110)May include surrounding context.

python

def get_crypto_prices():
    """获取加密货币价格数据（包含 sparkline 数据用于计算 EMA）"""
    ids = ','.join(TOKENS.values())
    url = f'https://api.coingecko.com/api/v3/coins/markets?vs_currency=usd&ids={ids}&order=market_cap_desc&sparkline=true&price_change_percentage=1h,24h,7d,30d'

    # 尝试 CoinGecko API（最多重试 2 次）
    for attempt in range(3):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto_monitor_telegram.py (reported line 70)May include surrounding context.

python

"""从 Binance API 获取加密货币价格数据（备用数据源）"""
    try:
        # 获取 24 小时价格变化
        ticker_url = 'https://api.binance.com/api/v3/ticker/24hr'
        response = requests.get(ticker_url, timeout=10)
        response.raise_for_status()
        tickers = response.json()

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s natural-language descriptions, user-facing output strings, and report text are all hard-coded in Chinese, indicating the skill operates in a single language without offering a user choice. This matches the language/locale policy concern because there is no opt-in, fallback, or documented region-specific justification in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module description and all user-facing output are written exclusively in Chinese, and the code hard-codes the Asia/Shanghai timezone for all reporting. This imposes a language/locale choice on users without any opt-in or documented regional limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

该 markdown 文件的全部标题和说明均以中文呈现，但未说明这是面向特定中文用户群体的区域化内容，也未提供用户可选择语言的提示。按照语言/locale 政策，若技能内容隐含强制单一语言而没有用户选择或明确正当理由，可视为自然语言策略违规。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The usage examples show commands and outputs that use both English and Chinese names, such as CPI 消费者价格指数, GDP 季度报告, and 失业率, but the document does not explain the language behavior or give users an option to choose a preferred locale. This can amount to an implicit language policy choice without opt-in.

Content

No source excerpt is available for this finding.