Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

CoinGlass API SKILL

v1.1.0

CoinGlass API skill. Routes to the appropriate sub-skill based on user intent. Covers futures, ETF, options, spots, on-chain, indicators, account, and other...

1· 104·0 current·0 all-time
byCoinGlass@coinglass-official

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for coinglass-official/coinglass-api-skills.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "CoinGlass API SKILL" (coinglass-official/coinglass-api-skills) from ClawHub.
Skill page: https://clawhub.ai/coinglass-official/coinglass-api-skills
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: curl
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install coinglass-api-skills

ClawHub CLI

Package manager switcher

npx clawhub@latest install coinglass-api-skills
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name and description (crypto market data across futures, spots, ETF, on-chain, etc.) match the provided API.md files and routing table. Requiring curl is reasonable for an instruction-only wrapper that runs HTTP requests.
!
Instruction Scope
The SKILL.md and per-endpoint API.md files instruct the agent to call CoinGlass endpoints via curl and include a CG-API-KEY header in examples (e.g. CG-API-KEY: ${YOUR_API_KEY}). The skill's root instructions tell the agent to read the sub-skill API.md files and follow them. There are no instructions to read local files, system configs, or unrelated environment variables, but the explicit use of ${YOUR_API_KEY} in many examples implies the agent will need an API key even though none is declared.
Install Mechanism
Instruction-only skill with no install spec and no code files — no files are written to disk and nothing is downloaded or executed beyond curl-initiated HTTP requests.
!
Credentials
Many API examples expect a CG-API-KEY header (placeholder ${YOUR_API_KEY}) but the registry metadata lists no required environment variables or primary credential. That mismatch is an incoherence: the skill will function only if an API key is provided, but it doesn't declare how the platform will receive/store that key. This omission increases risk of accidental key exposure if users paste keys into chat or otherwise supply them insecurely.
Persistence & Privilege
always is false and the skill is user-invocable with normal autonomous invocation allowed. There is no install or behavior that attempts to modify other skills or system configuration.
What to consider before installing
This skill is a documentation-style wrapper around the CoinGlass REST API and will make HTTP requests to open-api-v4.coinglass.com using curl. Before installing: 1) Expect to need a CoinGlass API key — the API docs show a CG-API-KEY header, but the skill does not declare any required env var or primary credential; confirm how you will provide the key on this platform. 2) Only provide a read-only / limited-scope API key (if possible); do not paste high-privilege or account-management keys into chat. 3) Verify the skill's source (the homepage points to a GitHub repo) and confirm it's the official integration. 4) Review which endpoints you will call — most examples are GET/read-only, but avoid supplying API keys with write/trade permissions. 5) If you need stronger assurances, ask the publisher to update the skill metadata to declare a required environment variable for the API key (so the platform handles it securely) and to document expected key scope.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binscurl
latestvk970ad1yfd1hfh1n3s0jt0h8k183w2dw
104downloads
1stars
4versions
Updated 4w ago
v1.1.0
MIT-0

CoinGlass API Skill

This is the root entry point for all CoinGlass API skills. It provides access to comprehensive crypto market data including futures, ETF flows, options, spot markets, on-chain data, indicators, and account information.

When a user request matches a sub-skill, read the corresponding API.md for that sub-skill and follow its instructions.


Routing Table

Based on the user's intent, route to the appropriate sub-skill:

Futures

User IntentSub-skill Path
Funding rate, funding historyfutures/funding-rate/API.md
Liquidation, liquidation heatmapfutures/liquidation/API.md
Long/short ratiofutures/long-short-ratio/API.md
Open interest, OI historyfutures/open-interest/API.md
Order book (L2), futures order bookfutures/order-book-l2/API.md
Taker buy/sell volume (futures)futures/taker-buy-sell/API.md
Futures trading market, market overviewfutures/trading-market/API.md
Hyperliquid positionsfutures/hyperliquid-positions/API.md

ETF

User IntentSub-skill Path
Bitcoin ETF, BTC ETF flowsetf/bitcoin-etf/API.md
Ethereum ETF, ETH ETF flowsetf/ethereum-etf/API.md
Solana ETF, SOL ETF flowsetf/solana-etf/API.md
XRP ETF flowsetf/xrp-etf/API.md
Grayscale, GBTC, ETHEetf/grayscale/API.md

Spots

User IntentSub-skill Path
Spot order bookspots/order-book/API.md
Spot taker buy/sell volumespots/taker-buy-sell/API.md
Spot trading market, spot market overviewspots/trading-market/API.md

Options

User IntentSub-skill Path
Options, put/call ratio, options flow, max painoptions/API.md

On-Chain

User IntentSub-skill Path
Exchange inflow/outflow, exchange reserveon-chain/exchange-data/API.md
Token on-chain data, holder distributionon-chain/token/API.md
On-chain transactions, whale transactionson-chain/transactions/API.md

Indicators

User IntentSub-skill Path
Futures indicatorsindic/futures/API.md
Spot indicatorsindic/spots/API.md
Other indicators, fear & greed, market sentimentindic/other/API.md

Other

User IntentSub-skill Path
Financial calendar, economic events, FOMCother/financial-calendar/API.md
Crypto newsother/news/API.md

Account

User IntentSub-skill Path
API account info, plan details, usageaccount/API.md

Rate Limits

Rate Limits HOBBYIST: 30 Rate limit/min STARTUP: 80 Rate limit/min STANDARD: 300 Rate limit/min PROFESSIONAL: 1200 Rate limit/min

Response Headers API-KEY-MAX-LIMIT: Indicates the maximum allowed request limit for your API key (per minute). API-KEY-USE-LIMIT: Shows the current usage count of your API key (requests made in the current time period).

Error Codes

For detailed information on error codes, please refer to Errors.

Comments

Loading comments...