Whale Alert Monitor 大户监控

This skill largely implements the advertised whale-monitoring functionality, but there are important inconsistencies you should resolve before installing or running it: - Do not trust embedded secrets: payment.py includes a hardcoded BILLING_API_KEY. Treat that as a red flag — ask the author why it's there and request its removal. Do not run these scripts on an environment that contains sensitive credentials or production access until this is resolved. - Clarify billing enforcement: _meta.json claims SkillPay billing is required, SKILL.md advertises per-call charges, but the main monitoring scripts do not clearly call the payment check. Ask whether the runtime will actually perform billing and which processes contact skillpay.me. If billing is required, prefer an implementation that uses a user-provided API key (via env var) and server-side billing verification instead of hardcoding keys. - Confirm network endpoints: alert manager sends to Telegram/Discord/webhook URLs supplied by env/config — those are expected. Confirm you are comfortable providing those notification credentials. Consider using a dedicated, limited bot/webhook rather than broad-purpose tokens. - Run in a sandbox first: execute the code in an isolated/test environment to observe runtime network behavior (which endpoints are contacted and when). Monitor outbound connections, and inspect logs for calls to skillpay.me or unexpected hosts. - If you plan to use this skill in production: request code changes from the maintainer to remove hardcoded keys, surface required env vars clearly, and add an audit log of billing calls. If the author cannot or will not address these issues, avoid installing the skill or only run it after manual code review and key removal. I assessed these issues with high confidence because the hardcoded key and metadata mismatch are directly visible in the repository.