Whale Alert Monitor 大户监控

This skill appears to implement the advertised whale-monitoring features, but there are important red flags you should address before using it: - Embedded secret: payment.py contains a hard-coded billing API key. Do NOT run this code until the author removes embedded secrets and requires credentials via environment variables or a secure vault. Embedded keys can be used by the publisher (or anyone with the code) to impersonate the billing service or to authorize unexpected charges. - Undeclared env vars: The skill reads TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, DISCORD_WEBHOOK_URL, CUSTOM_WEBHOOK_URL, and SKILLPAY_USER_ID but the skill metadata declared none. Confirm which environment variables are actually required and only populate tokens you trust. - Billing behavior: _meta.json marks SkillPay as required and SKILL.md states a per-call fee. Verify the legitimacy of the billing provider (skillpay.me), confirm pricing/authorization flow, and ensure the skill will not charge you unexpectedly. Prefer an implementation that requires explicit user consent and uses your own billing credentials (not an embedded key). - Network/data flow: The scripts call third-party APIs (Etherscan/Alchemy/Moralis) and send notifications externally. If you care about privacy, only provide API keys for services you control and review webhook endpoints (CUSTOM_WEBHOOK_URL) to avoid leaking monitored addresses to unknown receivers. - Recommended actions before installing: ask the publisher to (1) remove hard-coded keys, (2) list all required environment variables and configuration fields in the manifest, (3) document billing flow and how to provide SKILLPAY credentials securely, and (4) provide a reproducible way to run the code locally for audit (or open-source their billing backend). If the publisher cannot or will not fix these issues, treat the skill as untrusted and avoid running it with real credentials or in high-privilege environments.