Whale Alert Monitor 大户监控

Key issues for you to consider before installing or running this skill: - Hardcoded billing key: payment.py contains a plaintext BILLING_API_KEY value embedded in the repository. This is a security anti-pattern — the key may be valid, and its presence means anyone with the repo can use it. Ask the author to remove the key and use an environment variable instead. Treat the repository as potentially compromised until that key is verified or revoked. - Undeclared/unclear env vars: The registry shows no required env vars but the code clearly uses TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, DISCORD_WEBHOOK_URL, CUSTOM_WEBHOOK_URL, and blockchain API keys (Etherscan/Alchemy/Moralis). Confirm which secrets you must provide and why. Do not supply production/private credentials until you trust the code. - Billing behavior not enforced/unclear: _meta.json and SKILL.md state a per-call charge (0.01 USDT), but it is unclear which code paths enforce charges. Clarify whether the skill will charge automatically when invoked and how the billing key is used. If you are being asked to provide billing credentials, prefer a design where the skill reads your SKILLPAY_API_KEY from an env var (not the repo) and where billing calls are transparent. - Network activity & data flow: Running the scripts will call third-party APIs and send notifications to external services (Telegram/Discord/webhooks). If you need to preserve privacy or run in a restricted environment, run the skill in a sandbox or isolated environment first and monitor network traffic. - Recommended actions before use: 1) Do not run in production. Run in an isolated VM/container for initial testing. 2) Inspect/grep the repo for any other hardcoded secrets and remove/rotate any leaked keys. 3) Ask the publisher for authoritative documentation about billing (why a key is embedded, whether it's theirs, and whether it should be removed). If they cannot justify it, do not use the billing integration. 4) Replace embedded keys with environment-driven configuration, and ensure the skill only requires and documents the minimal secrets needed. 5) Consider a third-party code audit or at minimum run the scripts with network access blocked to see what local behavior happens. If you want, I can: (a) list all places the code reads environment variables and where network calls occur, (b) extract exact lines with hardcoded secrets, or (c) propose a minimal remediation patch to remove the embedded billing key and make billing read from env vars.