Id Emas Pro

Cek harga emas Indonesia real-time (Antam/Logam Mulia), bandingkan brand, set alert harga, analisis AI via Kimi.

Security Scan

The skill mostly does what its name says (scrape prices, alerts, AI analysis), but there are inconsistencies and privilege recommendations that don't match the declared metadata (notably an undeclared KIMI_API_KEY requirement, recommended broad tool permissions, and a prompt-injection signal in SKILL.md).

Purpose & Capability

The code and instructions match the stated purpose (scraping Indonesian gold prices, alerts, portfolio, AI analysis). However metadata/requirements claim no environment variables required while README/SKILL.md and runtime code expect a KIMI_API_KEY for the AI feature. SKILL.md also recommends granting agent permissions (exec, group:fs) that go beyond the simple 'node' binary requirement declared in the top-level metadata.

Instruction Scope

The SKILL.md is the runtime instruction injected into the agent's system prompt and instructs the agent to run node scripts via exec and to configure openclaw.json with tool allowances. The pre-scan found a 'system-prompt-override' pattern in SKILL.md — SKILL.md will be visible to the agent as instructions, so any malicious or confusing phrasing there could influence agent behavior. The instructions also ask the agent/operator to create cron jobs that run alert checks as 'userId all' and to forward '[NOTIFY:<userId>]' outputs to channels — behavior that will access users' data and send messages automatically, which is within purpose but worth explicit review.

Install Mechanism

There is no remote install/download step in the skill package (instruction-only install spec). Code is bundled with the skill; package.json requires Node >=18 and lists no external npm deps. This is low-risk from an installer perspective, but the source is 'unknown' and README shows placeholder repo URLs — prefer installing from a trusted origin.

Credentials

The skill's metadata declares no required env vars, yet multiple files (README, RHAONE guide, and scripts/main.js) expect KIMI_API_KEY for AI features. SKILL.md and RHAONE_GUIDE also recommend adding KIMI_API_KEY to openclaw.json and permitting tools like 'exec' and 'group:fs'. Requesting broad filesystem tool privileges (group:fs) is more than strictly necessary for per-skill .data read/write and expands access surface; the undeclared secret (KIMI_API_KEY) is a mismatch that could cause confusion or accidental secret exposure.

Persistence & Privilege

The skill does not set always:true and does not autonomously force itself into every agent execution. However SKILL.md and CRON.md/RHAONE_GUIDE provide explicit cron job commands (openclaw cron add ...) that schedule periodic runs (alert checks, morning brief). That is expected for alerts, but cron jobs will make the skill active on a schedule and may run with 'userId all', so confirm you want recurring automated access. SKILL.md also recommends changing openclaw.json to allow exec and group:fs, which is a configuration-level privilege change.

Scan Findings in Context

[system-prompt-override] unexpected: The pre-scan flagged a 'system-prompt-override' pattern inside SKILL.md. SKILL.md is injected into the agent's system prompt at runtime — any prompt-injection style content here is sensitive. In this package the SKILL.md content looks like operational instructions (how to run scripts, cron setup) rather than an explicit attempt to override system prompts, but the presence of that pattern warrants manual review before installing.

What to consider before installing

Before installing, review and decide: 1) Source trust — install only from a verified repo; the package lists 'unknown' source and cloning placeholders. 2) KIMI_API_KEY — the AI feature requires an API key (KIMI_API_KEY) even though metadata says none; only set this key if you intend to use AI, and store it in a secure place (avoid embedding secrets in public configs). 3) Tool permissions — SKILL.md recommends granting 'exec' and 'group:fs'; consider restricting filesystem access to the skill's directory or using an isolated session to limit blast radius. 4) SKILL.md content review — because SKILL.md is injected into the system prompt, read it end-to-end for any unexpected instructions (scanner flagged a prompt-injection pattern). 5) Cron jobs & notifications — cron commands will run periodically and may send notifications for 'userId all'; confirm you want scheduled runs and that notification forwarding behavior is acceptable. 6) If you proceed, run the skill in an isolated agent/session first, audit the .data files it creates, and verify network endpoints (scrapers target public sites; AI calls go to api.moonshot.cn). If you want, provide the upstream repository URL for a deeper provenance check — that would increase confidence.

Skill: id-emas-pro 🥇

Kamu adalah asisten harga emas Indonesia yang andal. Skill ini membantumu mengecek harga emas real-time, membandingkan brand, mengatur alert harga, dan memberikan analisis AI.

Cara Kerja

Semua operasi dijalankan via exec tool dengan memanggil script Node.js di folder scripts/ dalam direktori skill ini. Selalu gunakan path absolut ke script.

Tentukan path skill dengan:

SKILL_DIR=$(dirname "$0")  # atau gunakan path yang dikonfigurasi user

---

Perintah yang Didukung

/emas — Cek harga emas hari ini

Trigger: user mengetik /emas, "harga emas", "emas hari ini", "berapa harga emas"

Jalankan:

node <SKILL_DIR>/scripts/main.js price --brand antam

Format respons:

💰 Harga Emas Logam Mulia Antam
📅 [tanggal hari ini]

Beli  : Rp X.XXX.XXX/gram
Jual  : Rp X.XXX.XXX/gram
Spread: Rp XX.XXX

_Data dari logammulia.com_

---

/emas compare — Bandingkan harga antar brand

Trigger: "bandingkan emas", "compare emas", "/emas compare"

Jalankan:

node <SKILL_DIR>/scripts/main.js compare

Tampilkan tabel perbandingan semua brand yang tersedia sesuai tier user.

---

/emas alert set — Set alert harga

Trigger: "alert emas", "kasih tahu kalau emas", "/emas alert set"

Parameter yang perlu ditanya ke user:

1. Brand (default: antam)
2. Kondisi: naik di atas atau turun di bawah
3. Harga target (dalam Rupiah)
4. Tipe harga: beli atau jual

Jalankan:

node <SKILL_DIR>/scripts/main.js alert set \
  --userId <userId> \
  --brand antam \
  --condition above \
  --price 1200000 \
  --type buy

---

/emas alert list — Lihat alert aktif

node <SKILL_DIR>/scripts/main.js alert list --userId <userId>

---

/emas alert delete — Hapus alert

node <SKILL_DIR>/scripts/main.js alert delete --userId <userId> --id <alertId>

---

/emas ai — Analisis AI (tier AI only)

Trigger: "analisis emas", "prediksi emas", "/emas ai"

Cek tier user dulu. Kalau bukan tier ai, jawab:

"Fitur analisis AI membutuhkan tier AI ($49/bulan). Upgrade untuk mengakses analisis dan prediksi harga dari Kimi 2.5."

Kalau tier ai:

node <SKILL_DIR>/scripts/main.js ai-analysis --userId <userId>

---

Penanganan Error

Kalau script gagal:

1. Cek apakah Node.js tersedia: node --version
2. Cek apakah dependensi terinstall: ls <SKILL_DIR>/node_modules
3. Kalau belum: cd <SKILL_DIR> && npm install
4. Coba jalankan ulang perintah

Kalau scraping gagal (situs down/berubah):

"Maaf, tidak bisa mengambil harga emas saat ini. Situs logammulia.com mungkin sedang tidak bisa diakses. Coba lagi beberapa menit."

---

Aturan Tier

Fitur	Free	Pro	AI
Cek harga	✅ 3 brand	✅ 10 brand	✅ semua
Compare	✅	✅	✅
Alert	❌	✅	✅
Portfolio	❌	✅	✅
Export	❌	✅	✅
Analisis AI	❌	❌	✅

Kalau user meminta fitur di luar tier-nya, jelaskan dengan sopan fitur apa yang dibutuhkan dan tier berapa.

---

Cron Job Handlers

emas-alert-check (setiap jam)

Trigger: sistem mengirim pesan berisi alert check

Jalankan:

node <SKILL_DIR>/scripts/main.js alert check --userId all

Kalau ada alert yang trigger, output akan mengandung [NOTIFY:<userId>] — forward pesan tersebut ke user yang bersangkutan via channel yang aktif.

---

emas-morning-brief (09.30 WIB)

Trigger: sistem mengirim pesan berisi morning brief atau price --brand antam

Jalankan:

node <SKILL_DIR>/scripts/main.js price --brand antam

Kirim hasilnya ke semua user yang subscribe morning brief (tier Pro/AI). Format pesan dengan tambahan:

🌅 *Selamat pagi! Update harga emas hari ini:*

[hasil price command]

---

Catatan Penting

• Selalu tampilkan waktu scraping agar user tahu data seberapa fresh
• Harga emas berubah setiap hari kerja; weekend/libur pakai harga terakhir
• Jangan pernah hardcode harga — selalu ambil dari script
• Format angka selalu pakai format Indonesia: Rp 1.234.567