Upbit
v1.0.0Real-time cryptocurrency price lookup from Upbit (Korean KRW exchange). Use when user asks for Korean crypto prices, Upbit prices, domestic cryptocurrency ra...
⭐ 0· 332·0 current·0 all-time
by@lkjsays
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the runtime instructions: SKILL.md shows how to fetch real-time KRW market tickers from Upbit's public API and how to format results. Nothing requested or required contradicts this purpose.
Instruction Scope
Instructions are narrowly scoped to calling Upbit's public API (https://api.upbit.com/v1/ticker) and formatting the response. Minor inconsistency: examples use the curl CLI but the skill metadata does not declare curl as a required binary; otherwise the instructions do not read files, access secrets, or direct data to unexpected endpoints.
Install Mechanism
No install spec and no code files — instruction-only. This minimizes on-disk risk; nothing is downloaded or installed by the skill itself.
Credentials
The skill declares no environment variables or credentials and the instructions do not reference any secrets. Access requested (public API calls) is proportionate to the stated functionality.
Persistence & Privilege
always:false and no special privileges are requested. Autonomous invocation is allowed (platform default) but this is expected for a query-style skill; the skill does not request permanent presence or modify other skills/config.
Assessment
This skill appears to do only what it says: call Upbit's public ticker endpoint and format results. Before installing, note: (1) SKILL.md examples use curl — ensure the environment provides an HTTP client or update the instruction if needed; (2) the skill makes outbound network requests to api.upbit.com (expected for its purpose); (3) it requires no credentials, so there's no credential exfiltration risk from the skill itself, but any agent invocation will contact an external service — consider network and privacy policies; (4) the skill has no homepage and an unknown source/owner, so if provenance matters prefer a skill with a verifiable repo or publisher. If you need rate-limit guarantees, authentication, or signed source code, request a version with an explicit install/source and publisher information.Like a lobster shell, security has layers — review code before you run it.
latestvk979w90hmqeqay4ygwjdsyxn2d81z0fx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.