Btc Price Tracker

实时获取比特币价格，支持多货币显示，设置价格警报并通过 Telegram 收到通知，附带命令行操作和本地存储。

Security Scan

The skill appears to implement a legitimate BTC price watcher, but the package contents and metadata are inconsistent (bundled virtualenv, undeclared Telegram env var, and a prompt-injection scanner hit), so review and caution are advised before installing.

Purpose & Capability

Name/description match the code: the Python scripts fetch CoinGecko prices, store alerts locally, and print/send Telegram notifications. However, the published metadata claims 'instruction-only' / no required envs while the bundle contains 575 files (a full venv) — an oversized and disproportionate payload for a small price-tracker tool.

Instruction Scope

SKILL.md instructions are consistent with the stated purpose (how to view price, add/delete alerts, and Telegram setup). They reference an environment variable OPENCLAW_TELEGRAM_BOT_TOKEN and OpenClaw Gateway integration; that env var is used by the runtime in comments and docs but was not declared in the registry metadata. The runtime code operates only on local files (alerts.json, last_price.json) and CoinGecko API — there are no obvious instructions to read unrelated system files or exfiltrate data.

Install Mechanism

No install spec is provided (claimed instruction-only) but the package includes a complete virtualenv (venv/) and many vendored libraries. Bundling an entire venv is excessive for this functionality, increases attack surface, and is unusual for an instruction-only skill. There is no remote download/install step, but installing or executing these files would write many files to disk. This inflated artifact is disproportionate and should be reviewed.

Credentials

Registry metadata lists no required environment variables, but SKILL.md and code reference OPENCLAW_TELEGRAM_BOT_TOKEN and OPENCLAW_LANG (for Telegram notifications and language). This mismatch is a red flag: the skill requires credentials for Telegram integration (sensitive) but that was not declared. The number and type of envs requested are small and appropriate for Telegram notification, but they should be declared explicitly in metadata so users know what will be accessed.

Persistence & Privilege

The skill is not marked always:true and does not claim to alter other skills or system-wide configs. It persists only its own local files (alerts.json, last_price.json) in the skill directory. Autonomous invocation is allowed (platform default) but not combined here with any broad, undeclared privileges.

Scan Findings in Context

[unicode-control-chars] unexpected: The SKILL.md triggered a prompt-injection style pattern detector for unicode-control characters. The visible SKILL.md does not contain obvious malicious prompts, but the presence of control/unicode manipulation patterns in documentation is unusual and should be inspected. This finding alone is not proof of malicious intent but increases suspicion given the other inconsistencies.

What to consider before installing

What to consider before installing: 1) Metadata vs. reality: The registry says 'no env vars' and 'instruction-only', but the package includes a full Python virtualenv (venv/) and the docs/code reference OPENCLAW_TELEGRAM_BOT_TOKEN. Ask the publisher to correct metadata or remove the bundled venv. Do not assume the skill is safe because metadata omitted env requirements. 2) Telegram token: If you enable Telegram notifications you must provide a bot token (sensitive). Only set OPENCLAW_TELEGRAM_BOT_TOKEN if you trust the skill. Prefer creating a minimally privileged bot and revoke it if anything looks off. 3) Inspect the bundle: Because the repo contains many files (including third-party libraries), inspect for hardcoded secrets or unexpected network endpoints. Search for any occurrences of 'http://' to unknown hosts, IP addresses, or embedded credentials. So far the code calls CoinGecko and prints Telegram messages; no hidden remote endpoints were obviously found in the reviewed files. 4) Run in isolation: If you test it, run the scripts in an isolated environment (container or VM) and avoid giving it more permissions than needed. Remove or recreate the virtualenv from a known-good requirements.txt (pip install -r requirements.txt) rather than using the included venv. 5) Address the scanner hit: The pre-scan flagged unicode-control-chars in SKILL.md. Request clarification from the author or ask them to re-publish without hidden/control characters. Treat this as an explanation request rather than automatic proof of maliciousness. 6) What would reduce my concern: (a) updated registry metadata declaring OPENCLAW_TELEGRAM_BOT_TOKEN as a required env var, (b) removal of the bundled venv (or explanation why it was included), (c) a known/trusted publisher identity or homepage, and (d) a minimal source-only release (no vendored site-packages). Given the inconsistent packaging and the scanner hit, proceed with caution — the code looks coherent with the advertised function, but the packaging and metadata mismatches are suspicious and warrant a manual review before granting credentials or running in production.

一个比特币实时价格监控和警报系统，支持通过 Telegram 接收价格通知。

功能特性

• ✅ 使用 CoinGecko 免费 API 获取比特币实时价格（无需 API Key）
• ✅ 支持多货币显示（USD、CNY、SGD）
• ✅ 设置价格警报（高于/低于某个价位）
• ✅ 通过 Telegram 发送警报通知
• ✅ 命令行交互界面
• ✅ 本地 JSON 存储警报数据
• ✅ 完善的错误处理和网络超时
• ✅ 多语言支持（中文/英文）

安装

# 安装依赖
pip install requests

# 或者使用技能安装器
clawhub install btc-price-tracker

使用方法

查看当前价格

# 查看比特币价格（默认 USD）
btc-price-tracker price

# 示例输出:
# 💰 比特币当前价格：
#   USD: $67,234.56
#   CNY: ¥486,789.12
#   SGD: S$90,123.45
#   24h 变化：📈 2.34%

设置价格警报

# 当价格高于 100,000 USD 时通知
btc-price-tracker alert --name "高价警报" --price 100000 --condition above --currency USD

# 当价格低于 60,000 CNY 时通知
btc-price-tracker alert --name "低价警报" --price 60000 --condition below --currency CNY

# 参数说明:
#   --name, -n        警报名称（必填）
#   --price, -p       目标价格（必填）
#   --condition, -c   触发条件：above(高于) 或 below(低于)
#   --currency, -C    货币单位：USD, CNY, SGD（默认 USD）

查看警报列表

btc-price-tracker alerts

# 示例输出:
# 📋 当前警报列表：
# ------------------------------------------------------------
# ✅ #1 高价警报
#    条件：当价格 高于 $100,000.00
#    创建：2026-03-31T11:14:30
# ✅ #2 低价警报
#    条件：当价格 低于 ¥60,000.00
#    创建：2026-03-31T11:15:00
# ------------------------------------------------------------

删除警报

# 删除 ID 为 1 的警报
btc-price-tracker delete 1

检查警报

# 手动检查是否触发警报
btc-price-tracker check

Telegram 集成

当价格警报触发时，会自动通过 Telegram 发送通知：

🚨 警报触发！高价警报：当前价格 $100,234.56 高于 $100,000.00

配置 Telegram

在 OpenClaw 环境中，Telegram 通知会自动通过主程序发送。确保：

1. OpenClaw Gateway 已启动
2. Telegram 频道已配置
3. 环境变量 OPENCLAW_TELEGRAM_BOT_TOKEN 已设置

环境变量

# 设置语言（zh 或 en）
export OPENCLAW_LANG=zh

# Telegram Bot Token（用于发送通知）
export OPENCLAW_TELEGRAM_BOT_TOKEN=your_bot_token

数据存储

警报数据保存在技能目录下的 alerts.json 文件中：

[
  {
    "id": 1,
    "name": "高价警报",
    "price": 100000,
    "condition": "above",
    "currency": "USD",
    "active": true,
    "created_at": "2026-03-31T11:14:30"
  }
]

API 说明

本技能使用 CoinGecko 免费 API：

• 无需 API Key
• 免费调用限额：10-50 次/分钟
• 数据包含：USD、CNY、SGD 价格及 24 小时涨跌幅

错误处理

技能包含完善的错误处理：

• 🌐 网络超时（10 秒）
• 🔌 连接错误
• 📄 JSON 解析错误
• 💾 文件读写错误

所有错误都会以友好的中文/英文消息显示。

技术栈

• Python 3.7+
• requests（HTTP 客户端）
• json（数据持久化）
• argparse（命令行解析）

限制

• CoinGecko 免费 API 有调用频率限制（建议不超过 1 次/分钟）
• 警报数据仅保存在本地，不会同步到云端
• 仅支持比特币（BTC），不支持其他加密货币

未来计划

• 支持其他加密货币（ETH、BNB 等）
• 添加价格历史图表
• 支持邮件通知
• 添加价格趋势分析
• 支持警报组（批量管理）

贡献

欢迎提交 Issue 和 Pull Request！

许可证

MIT License

作者

OpenClaw Community

---

提示: 定期检查价格警报，合理设置触发条件，避免频繁触发。