Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Binance Square Post

v1.1.0

发送内容到 Binance Square(币安广场)。 支持纯文字帖子,可带 $代币标签(如 $BTC)和 #话题标签。 集成每日新闻简报功能,自动获取 Web3/AI 热点并发布到 Square。 用户需要先配置自己的 API Key 才能使用。

0· 131·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for renyuke-cn/binance-square-publish.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Binance Square Post" (renyuke-cn/binance-square-publish) from ClawHub.
Skill page: https://clawhub.ai/renyuke-cn/binance-square-publish
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install binance-square-publish

ClawHub CLI

Package manager switcher

npx clawhub@latest install binance-square-publish
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Functionality (post text to Binance Square, fetch news from external API, publish daily digest) is coherent with the name/description. However the skill does not declare any required credentials in the registry metadata while the SKILL.md instructs the user to embed their Square OpenAPI Key into the skill config (a mismatch between declared requirements and actual needs).
!
Instruction Scope
Runtime instructions only call Binance Square endpoints and third‑party news endpoints (6551.io), which is consistent with posting and auto-news features. Concerns: it tells users to place their API key directly in SKILL.md (plaintext secret storage), and it enables scheduled automatic fetching from 6551.io and posting to Binance — this gives the skill authority to autonomously publish content using the user's key. The instructions do not limit or sanitize content sources beyond 'A+ filtering', and they provide broad discretion for automatic generation and posting.
Install Mechanism
This is an instruction-only skill with no install spec and no files executed on install, which minimizes installation-level risk. There are no downloads, packages, or binaries installed by the skill.
!
Credentials
The skill requires the user's Binance Square OpenAPI Key to function but the registry lists no required env vars or primary credential; instead the SKILL.md instructs embedding the key in the skill file. This is disproportionate from a configuration/secret-handling best-practices perspective. The skill also calls an external third-party API (ai.6551.io) — while that service doesn't require credentials in the doc, automatic fetches mean external content can influence what is posted under the user's identity.
Persistence & Privilege
The skill is not marked 'always: true'. Autonomous invocation is allowed (default) and the SKILL.md explicitly supports scheduled daily posts (cron), which could result in recurring autonomous posts using the user's API key. That is expected for an auto-posting skill, but it increases blast radius if the key is misconfigured or the source feeds are untrusted.
What to consider before installing
Before installing: 1) Do not paste your Binance API key into a repository or plain SKILL.md if that file can be stored/shared — prefer the platform's secret store or environment variables. 2) Verify the Binance endpoint and header names against official Binance Square OpenAPI docs to ensure authenticity. 3) Limit the API key permissions (use minimal scopes) and create a key you can safely rotate. 4) Be cautious enabling daily automatic posts — test manual posting first to confirm content formatting and filtering. 5) Vet the third-party news source (https://ai.6551.io); automatic fetching means external content can be posted under your account. 6) Monitor activity and rotate/revoke the key immediately if you see unexpected posts. If you cannot avoid storing the key in a file, never commit that file to shared repos and consider using a dedicated, low-permission key for testing.

Like a lobster shell, security has layers — review code before you run it.

latestvk974nw32rr34bheht9zt7mx5xh83c2ce
131downloads
0stars
2versions
Updated 1mo ago
v1.1.0
MIT-0

Binance Square Post Skill

概述

将文字内容发布到 Binance Square(币安广场社交平台),支持自动生成并发布每日新闻简报。

使用前配置

用户需要先配置自己的 Square OpenAPI Key:

获取 API Key

  1. 登录 Binance 账户
  2. 访问 Binance Square OpenAPI 页面
  3. 创建或获取你的 OpenAPI Key

配置方法

在 skill 文件中添加配置:

config:
  accounts:
    - name: default
      api_key: 你的API密钥

功能 1:手动发帖

API 调用

Endpoint

POST https://www.binance.com/bapi/composite/v1/public/pgc/openApi/content/add

Headers

Header必填说明
X-Square-OpenAPI-Key你的 Square OpenAPI Key
Content-Typeapplication/json
clienttypebinanceSkill

Body

字段类型必填说明
bodyTextOnlystring帖子内容(支持 $代币标签和 #话题标签)

示例

curl -X POST 'https://www.binance.com/bapi/composite/v1/public/pgc/openApi/content/add' \
  -H 'X-Square-OpenAPI-Key: 你的API密钥' \
  -H 'Content-Type: application/json' \
  -H 'clienttype: binanceSkill' \
  -d '{
    "bodyTextOnly": "Hello Binance Square! $BTC #Crypto"
  }'

响应

成功响应:

{
  "code": "000000",
  "message": null,
  "data": {
    "id": "123456789012345"
  },
  "success": true
}

帖子链接:https://www.binance.com/square/post/{id}


功能 2:自动每日新闻简报

数据源

使用 6551 API 获取每日热点新闻:

  • Web3 新闻:GET https://ai.6551.io/open/free_hot?category=web3
  • AI 新闻:GET https://ai.6551.io/open/free_hot?category=ai
  • 宏观新闻:GET https://ai.6551.io/open/free_hot?category=macro

自动生成简报流程

  1. 调用以上 API 获取当日热点新闻
  2. 筛选高质量内容(A+ 级)
  3. 整理成简报格式
  4. 调用 Binance Square API 发布

简报模板

📰 每日新闻简报 - [日期]

🔥 今日热点
1️⃣ [热点1]
2️⃣ [热点2]
3️⃣ [热点3]
4️⃣ [热点4]
5️⃣ [热点5]

---

#每日新闻 #Web3 #AI #加密货币

定时任务配置(可选)

用户可以通过 OpenClaw cron 设置每日自动发布:

任务时间:每天北京时间 00:00(早上8点)

错误码

错误码说明
000000成功
10004网络错误,请重试
10005仅限已完成身份验证的用户
10007功能不可用
20002检测到敏感词
20013内容长度受限
20020发布空内容不被支持
30004用户未找到
30008因违规被禁言
220003API Key 未找到
220004API Key 已过期
220009每日发帖上限已达

使用示例

示例 1:简单发帖

用户:发一条帖子到 Binance Square,内容是 "Hello World"

示例 2:币圈分析发帖

用户:帮我发一条关于 $BTC 行情分析的帖子

  1. 查询代币当前价格(使用 query-token-info skill)
  2. 构造分析内容
  3. 调用 API 发送

示例 3:发布每日新闻简报

用户:生成并发布今日新闻简报

  1. 获取 Web3/AI/宏观 新闻
  2. 筛选热点内容
  3. 生成简报
  4. 发布到 Square
  5. 返回帖子链接

示例 4:带话题标签

$BTC #比特币 #加密货币 #行情分析

安全注意事项

  1. 永远不要在公开场合暴露完整的 API Key
  2. 显示 API Key 时只显示首5位+末4位,如:abc12...xyz9
  3. 定期检查 API Key 权限设置
  4. 如发现异常,及时在 Binance 官网重置 Key

注意事项

  1. 目前仅支持纯文字帖子(不支持图片、视频)
  2. 内容长度有限制(避免超过 2000 字符)
  3. 建议帖子内容加上热门话题标签以获得更多曝光
  4. 每日简报会自动筛选高质量新闻,确保内容价值

Comments

Loading comments...