BSC Analytics BSC生态分析

What to consider before installing: - The code is mostly benign analytics (monitoring, evaluator, yield calc) and matches the BSC-analytics description, but pay attention to payment.py and _meta.json: they contain a hard-coded SkillPay API key that will be sent to https://api.skillpay.io when verify_payment is called. That can leak the key and transmit user wallet addresses/timestamps to a third party. - If you do not want any external network calls or data sent to SkillPay, do not install or run this skill as-is. Ask the author why a payment API key is embedded instead of requiring an environment variable and why SKILL.md does not disclose payment enforcement. - If you still want to use the analytics logic: (1) Inspect/grep the code; (2) Remove or rewrite payment.py, or replace the hard-coded key with a configuration that you control (ENV var); (3) Run in an isolated environment (no network) or with outbound network blocked until you validate behaviour; (4) Do not provide wallet addresses or sensitive info until you trust the payment endpoint. - Consider requesting the publisher to (a) remove secrets from source and declare payment requirements in SKILL.md, (b) document when and how payment verification occurs, and (c) provide an option to run analytics in offline/free mode. - If you cannot verify the author or the SkillPay endpoint, treat the embedded API key as compromised and avoid using the skill with real wallet info.