Signalbot

What to consider before installing: - Review the upstream GitHub repository (https://github.com/shanhuhai5739/signalbot) and prefer a tagged/verified release rather than @latest. Look at recent commits, contributors, and issues. - Do not allow the agent to run the automatic install without review. The SKILL.md explicitly says to run `go install ...` automatically — this will fetch and compile arbitrary code from the network and place a binary on disk. - If you decide to install, run the install manually in a controlled environment first (e.g., local sandbox or VM), inspect the source or the built binary, and avoid running as root. Consider building from a specific commit tag or release and pinning the version. - Be cautious about following instructions that copy the binary into /usr/local/bin or add cron jobs; those steps require elevated permissions and create persistence. If you need scheduled runs, prefer platform-level scheduling you control or review the cron job contents before enabling. - If you need network isolation, run the binary with restricted network access or point BINANCE_BASE_URL to a trusted proxy. Prefer to provide only the minimum configuration required and avoid exposing credentials. - If you want higher assurance, ask the maintainer for signed releases, reproducible build info, or a checksum for the release binaries before installing.