Back to skill
Skillv1.0.0
ClawScan security
Korea Flow — Orion · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
ReviewMar 16, 2026, 12:31 AM
- Verdict
- Review
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill claims to provide real-time Korean crypto signals but the instructions contain no mechanism or credentials to fetch live exchange data, so outputs may be fabricated and the skill primarily funnels users to a paid service.
- Guidance
- This skill may produce plausible-sounding market numbers without any real-time data feed. Before installing or relying on outputs: (1) ask the author which exchange APIs or data sources the skill uses and how freshness is guaranteed; (2) request that the skill declare any required API keys/credentials if it truly connects to Upbit/Bithumb; (3) test the skill's outputs against known public data to detect hallucinations; (4) do not use its numbers for live trading until provenance is verified; and (5) be cautious about following the paid 'Orion ACP' funnel—verify the provider identity and payment flow on the linked site and avoid sharing secrets or funds without independent verification.
Review Dimensions
- Purpose & Capability
- concernName/description promise real-time kimchi premium and volume trends, but SKILL.md contains no API endpoints, data sources, required credentials, or instructions to query Upbit/Bithumb (or any market feed). A skill that genuinely delivers live exchange metrics would normally declare data sources or require API access; the absence suggests the agent would either hallucinate numbers or rely on out-of-date internal knowledge.
- Instruction Scope
- concernRuntime instructions only say to return a snapshot (direction, volume surge, one-line read) and to route users to hire a paid ACP agent; they do not instruct how to obtain or verify live data. The instructions are vague and permit the agent to invent numeric spreads and volume changes. They also direct users to an external hiring flow (virtuals.io).
- Install Mechanism
- okInstruction-only skill with no install spec, no code files, and no downloads — low risk from an installation perspective.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths, which is proportionate to an agent that only returns a canned snapshot. However, because the skill claims to be real-time but declares no access to exchange APIs, the lack of required credentials is another signal that live data fetching is not implemented.
- Persistence & Privilege
- okDoes not request always:true or other elevated persistence. Default autonomous invocation is allowed (platform default), and nothing in the skill attempts to change other skills or system settings.