Whale Alert Monitor 鲸鱼预警

Key issues to consider before installing or running this skill: - Hard-coded billing key: payment.py contains a baked-in BILLING_API_KEY. Embedded secrets are a security risk (leakage, abuse). Ask the author to remove the key and require the billing API key via an environment variable or other secure secret store. If you already ran this code, consider the key compromised and contact the billing provider to rotate/revoke it. - Billing behavior unclear: _meta.json and SKILL.md indicate SkillPay billing; the code includes functions that will call the billing API and may terminate the skill if payment isn’t verified. Confirm whether the skill will attempt to charge or call the billing endpoint automatically on start, and whether it can run in a read-only/demo mode without network billing calls. - Undeclared environment variables: The registry entry declares no required env vars, but the scripts expect TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, DISCORD_WEBHOOK_URL, CUSTOM_WEBHOOK_URL, and SKILLPAY_* vars. The mismatch is an operational risk — the skill may attempt external network calls or fail unexpectedly. Require the author to document and declare required env vars in metadata. - Network calls: Alerting and billing make outbound HTTP requests (SkillPay, Telegram, Discord, custom webhooks). If you run this in an environment with sensitive data or restricted network access, be mindful of where alerts/payment calls go. - Code review & testing: The bulk of the scripts use simulated data for demonstrations (many fetch_* functions generate synthetic data), but confirm which modules actually call blockchain APIs in your deployed version. Run the code in an isolated environment first and audit all network interactions (e.g., with a proxy) before giving it access to production secrets. - Recommended actions: 1) Ask the author to remove hard-coded secrets and to publish clear env var requirements; 2) Request explicit documentation on when billing calls are made and to which user_id; 3) Run the skill in a sandboxed environment and monitor outbound traffic; 4) Rotate any exposed keys if you or your environment already used them. Given these inconsistencies and the embedded API key, treat the package as suspicious until the billing integration and secret management are clarified or fixed.