coin-news-openclaw

Collect and summarize cryptocurrency and coin market news with OpenClaw-friendly workflows. Use when users request coin news, crypto news, token-specific new...

Security Scan

The skill mostly matches its stated purpose (collecting and scoring crypto news), but there are a few inconsistencies—most notably undeclared runtime dependencies and a prompt-injection signal (unicode control characters) in SKILL.md—that warrant review before installation.

Purpose & Capability

Name, description, SKILL.md workflow, included YAMLs, and the Python script all align: the skill fetches RSS feeds, uses CoinGecko for dynamic tokens, scores and deduplicates articles, and returns JSON/Markdown digests. Writing a local scoring.yaml for caching dynamic tokens is coherent with the stated behavior.

Instruction Scope

SKILL.md instructions are narrowly scoped to reading references/*.yaml, optionally running scripts/fetch_coin_news.py, ranking/filtering, and returning a digest. However, SKILL.md contains a detected prompt-injection signal (unicode-control-chars) and the JSON example includes non-ASCII/curly quotes — this could be accidental formatting or an attempt to influence downstream processing and should be reviewed.

Install Mechanism

There is no install spec (instruction-only), which minimizes install risk. However, the included Python script imports 'yaml' (PyYAML) and assumes python3; the skill metadata declares no required binaries or packages. The missing declaration of Python/PyYAML is an inconsistency the user should address (or run in an environment where PyYAML is present).

Credentials

The skill requests no environment variables, no credentials, and accesses only public RSS feeds and CoinGecko (no API key). Network access to those public endpoints is required and proportionate. The script writes/updates scoring.yaml in the skill directory to cache dynamic tokens — this local file write is expected but worth noting.

Persistence & Privilege

The skill does not request permanent/global privileges and 'always' is false. It modifies only its own scoring.yaml (caching dynamic tokens), which is consistent with its purpose and does not appear to alter other skills or system-wide settings.

Scan Findings in Context

[unicode-control-chars] unexpected: SKILL.md triggered a unicode-control-chars detection. The file also contains non-ASCII/curly quotes in the JSON example. This may be harmless formatting, but it could also be an attempt to influence prompt parsing or to hide content. Inspect SKILL.md for hidden characters and normalize quotes.

What to consider before installing

This skill appears to do what it claims: fetch RSS crypto news, score, dedupe, and output a digest. Before installing or running it, consider: 1) Run it in a sandboxed environment because it makes outbound network calls to CoinGecko and the RSS URLs listed in references/sources.yaml. 2) Ensure python3 and PyYAML (yaml) are installed (the script imports 'yaml' but the skill metadata does not declare it). 3) Review and approve the sources.yaml and scoring.yaml contents (the script will write/update references/scoring.yaml to cache dynamic tokens). 4) Inspect SKILL.md for the reported unicode control characters and replace smart quotes with standard ASCII quotes in the JSON example to avoid parsing surprises and rule out prompt-injection attempts. 5) If you require stricter controls, ask the author to: declare runtime dependencies, remove or explain any non-printable characters, and optionally add an install spec that pins trusted package versions. If these points are addressed, the skill looks coherent; if not, treat it cautiously or run it only in an isolated environment.

Collect cryptocurrency news from configurable sources, normalize the articles, score relevance, and return a structured digest that can be tuned over time.

Use This Skill When

• The user wants a daily or on-demand crypto news digest
• The user wants news for a specific token or narrative
• The user wants to replace or compare against an existing Dify news workflow
• The user wants a configurable pipeline that PA can tune later

Workflow

1. Read references/sources.yaml to determine enabled sources and source weights.
2. Read references/scoring.yaml to determine token aliases, topic keywords, negative keywords, and ranking logic.
3. If deterministic collection is needed, run scripts/fetch_coin_news.py.
4. Filter the normalized article list to the user’s requested scope.
5. Rank articles using source weight, keyword matches, recency, and duplicate suppression.
6. Return a short digest or a structured JSON array for downstream workflow use.

CLI Usage

# Basic usage - JSON output (default)
python3 scripts/fetch_coin_news.py --days 1

# ⭐ Markdown output with clickable links (recommended for reading)
python3 scripts/fetch_coin_news.py --days 1 --format markdown

# Limit number of articles
python3 scripts/fetch_coin_news.py --days 1 --limit 10 --format markdown

# Filter by specific tokens
python3 scripts/fetch_coin_news.py --days 1 --token BTC --token ETH

# Filter by specific topics
python3 scripts/fetch_coin_news.py --days 1 --topic etf --topic regulation

# Adjust token fetch limit (default: 100, max: 250)
python3 scripts/fetch_coin_news.py --days 1 --token-limit 50

# Disable dynamic token fetching (use only YAML config)
python3 scripts/fetch_coin_news.py --days 1 --no-dynamic-tokens

Output Formats

JSON (default)

python3 scripts/fetch_coin_news.py --days 1

Returns structured JSON for programmatic use.

Markdown (recommended for reading)

python3 scripts/fetch_coin_news.py --days 1 --format markdown

Returns formatted markdown with clickable links for each article:

## 1. [Article Title](https://example.com/article)
**来源**: CoinDesk | **时间**: 2026-03-25 | **分数**: 78
**Token**: BTC, ETH
**主题**: etf

Summary text here...
---

Time Range

• Default: last 24 hours
• Support explicit day windows such as:
  • recent 2 days
  • recent 3 days
  • recent 7 days
• Support common Chinese requests such as:
  • 最近2天
  • 最近3天
  • 最近一周
  • 过去7天
• For deterministic runs, prefer --days <n> over manually converting to hours.
• If both --days and --hours are provided, --days takes precedence.
• Recommended mapping:
  • 最近2天 -> --days 2
  • 最近3天 -> --days 3
  • 最近一周 -> --days 7
  • 过去7天 -> --days 7

Dynamic Token Fetching

The skill automatically fetches the top 100 tokens (by market cap) from CoinGecko API and merges them with the YAML config:

• Source: CoinGecko API (free, no API key required)
• Cache TTL: 24 hours (stored in scoring.yaml under dynamic_tokens)
• Merge logic: YAML token_aliases overrides dynamic tokens (for manual tuning)
• Disable: Use --no-dynamic-tokens to use only YAML config

Output Contract

Prefer this JSON structure for workflow handoff:

[
  {
    “title”: “Example headline”,
    “url”: “https://example.com/article”,
    “source”: “CoinDesk”,
    “published_at”: “2026-03-20T09:00:00Z”,
    “summary”: “One paragraph summary.”,
    “score”: 78,
    “matched_topics”: [“bitcoin”, “etf”],
    “matched_tokens”: [“BTC”],
    “duplicate_group_key”: “normalized-title-key”
  }
]

Tuning Rules

• Do not hardcode source lists in prompts. Update references/sources.yaml.
• Do not hardcode scoring logic in prompts. Update references/scoring.yaml.
• Prefer established publications before secondary aggregators.
• If the user asks for “latest” or “today”, prioritize the last 24 hours and show exact dates.

References

• references/sources.yaml: source registry and weights
• references/scoring.yaml: token aliases, topic keywords, penalties, thresholds
• scripts/fetch_coin_news.py: deterministic RSS collector and scorer