Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Crypto Analyst

v1.1.1

加密货币综合分析工具,整合OKX、Binance双交易所数据。提供行情查询、技术分析、交易信号、资金流向、仓位管理、DCA计划、风险计算。触发词:分析BTC、行情查询、交易信号、仓位计算、DCA计划、巨鲸追踪、风险评估。

0· 132·0 current·0 all-time
byYirong@erongcao

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for erongcao/crypto-analyst.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Crypto Analyst" (erongcao/crypto-analyst) from ClawHub.
Skill page: https://clawhub.ai/erongcao/crypto-analyst
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install crypto-analyst

ClawHub CLI

Package manager switcher

npx clawhub@latest install crypto-analyst
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description promise: OKX+Binance analysis, signals, DCA, position sizing. The shipped scripts implement those features (okx_analyst.py, binance_market.py, dca_calculator.py, position_sizer.py, etc.). Requiring OKX API credentials for balance/OKX private endpoints aligns with the stated features. However, repository metadata in _meta.json (ownerId, slug, version) does not match the registry metadata provided, which is an inconsistency in packaging/source provenance that reduces trust.
Instruction Scope
SKILL.md instructs the agent to run contained Python scripts and to place OKX credentials in a .env. The scripts read .env (project root or script dir) and use network APIs (OKX, Binance, alternative.me, ns3.ai) consistent with the stated purpose. No instructions ask the agent to read unrelated system files. Minor issue: SKILL.md references copying .env.example to .env, but no .env.example is present in the file manifest—so the user must create the .env manually. Also several scripts were truncated in the provided listing; those omitted files should be reviewed before trusting the package.
Install Mechanism
No installation spec is provided (instruction-only install), and the SKILL.md lists reasonable Python dependencies (requests, pandas, numpy, python-dotenv, akshare). There are no remote downloads or archive extraction steps in the manifest, which lowers install-time risk.
Credentials
Only exchange credentials (OKX API key, secret, passphrase) are needed for the OKX-only features; no unrelated credentials are requested. The scripts load .env files into environment variables at runtime — this is expected for API keys but means plaintext secrets in a project .env file could be read by the scripts. The code accesses only those env vars declared in SKILL.md and the scripts; I did not find requests for unrelated secrets in the visible files.
Persistence & Privilege
Flags show always:false and normal autonomous invocation allowed. The package does not request persistent system-wide privileges or attempt to modify other skills; it is a normal, on-demand toolset.
What to consider before installing
What to check before installing or running: - Provenance: _meta.json (owner, slug, version) does not match the registry metadata shown — confirm the publisher/source before trusting code that handles API keys. - Secrets: The tools ask you to store OKX API_KEY/SECRET/PASSPHRASE in a .env file which the scripts will load. Only provide keys with the minimum permissions needed (read-only where possible) and avoid putting long-term trading keys into this directory unless you trust the source. - Missing files: SKILL.md suggests a .env.example but none is in the manifest; create .env carefully and verify names match the scripts (OKX_API_KEY, OKX_API_SECRET, OKX_API_PASSPHRASE). - External endpoints: The analyzer fetches news from a third-party NS3 endpoint (api.ns3.ai) and alternative.me for Fear & Greed; confirm you are comfortable with those telemetry/requests and that no other unknown remote endpoints exist in the omitted files. - Code review: A few scripts were truncated in the provided listing. If you will run these tools with real account credentials, review the remaining files (whale_tracker.py, technical_analysis.py or any omitted files) for any unexpected behavior (credential transmission to unknown servers, hidden POST/PUT calls, or file writes). If you lack the ability to audit, prefer using read-only API keys or running the scripts in an isolated environment. - Operational precaution: Run first with no credentials (or read-only keys) to verify behavior, and consider running inside a disposable container or VM. If you need higher assurance, ask the publisher for a signed release or review the full source history.

Like a lobster shell, security has layers — review code before you run it.

latestvk973n6cm36x2a5hcxx96kptj5d84g8yh
132downloads
0stars
2versions
Updated 2w ago
v1.1.1
MIT-0

Crypto Analyst v1.1

加密货币综合分析,统一调用 OKX、Binance、AKShare 三大数据源。

工作流

价格查询 → 技术分析 → 资金流向 → 策略建议 → 仓位管理

工具速查

需求工具数据源备注
OKX技术分析/信号okx_analyst.pyOKX API需要API Key
Binance实时行情binance_market.pyBinance公开API自动降级至Binance US
Binance技术分析technical_analysis.pyBinance公开API同上
双交易所价格对比cross_exchange.pyOKX + Binance US发现套利机会
巨鲸追踪whale_tracker.pyBinance≥$10,000才算巨鲸
DCA定投计划dca_calculator.pyOKX实时价格自动获取BTC价格
仓位计算position_sizer.py本地计算
市场机会扫描market_scanner.pyBinance过滤<$1M日成交量
恐惧&贪婪fear_greed.pyalternative.me每日约8:00更新
OKX余额查询balance_check.pyOKX API需要Key+Secret+Passphrase

快速命令

日常行情分析

# OKX技术分析(完整报告)
python3 scripts/okx_analyst.py BTC-USDT

# OKX快速信号
python3 scripts/okx_analyst.py BTC-USDT --signal-only

# Binance实时价格+24h统计
python3 scripts/binance_market.py --symbol BTCUSDT --all

# Binance技术分析
python3 scripts/technical_analysis.py --symbol BTCUSDT --interval 1h

进阶分析

# 跨交易所价格对比(发现价差套利机会)
python3 scripts/cross_exchange.py BTC

# 巨鲸追踪(只统计≥$10,000的大单)
python3 scripts/whale_tracker.py --symbol BTCUSDT

# 市场机会扫描(过滤低流动性,日成交>$1M)
python3 scripts/market_scanner.py --gainers --limit 10

# 恐惧&贪婪指数
python3 scripts/fear_greed.py

策略工具

# DCA定投计划(自动获取当前BTC价格)
python3 scripts/dca_calculator.py --total 5000 --frequency weekly --duration 180

# DCA手动指定价格+情景分析
python3 scripts/dca_calculator.py --total 5000 --frequency weekly --duration 180 --current-price 70000 --scenarios

# 仓位计算(2%风控)
python3 scripts/position_sizer.py --balance 10000 --risk 2 --entry 70000 --stop-loss 67000

标准分析流程

当用户说"分析BTC"或"帮我看看行情"时:

Step 1 - 价格 & 趋势

# OKX 4H周期完整分析
python3 scripts/okx_analyst.py BTC-USDT --timeframe 4H

# Binance 1H作为辅助确认
python3 scripts/binance_market.py --symbol BTCUSDT --klines 1h --limit 50

Step 2 - 资金面

# 巨鲸动向(自动过滤<$10,000小额噪声)
python3 scripts/whale_tracker.py --symbol BTCUSDT

# 交易所资金费率(判断多空情绪)
python3 scripts/binance_market.py --symbol BTCUSDT --funding

Step 3 - 市场情绪

# 恐惧&贪婪(注意:每天约8:00 UTC更新一次)
python3 scripts/fear_greed.py

Step 4 - 策略输出 综合以上给出:

  1. 当前信号(看涨/看跌/中性)
  2. 关键支撑/阻力位
  3. 入场区间
  4. 止损/止盈建议
  5. 仓位大小(风控)
  6. 风险提示

信号强度说明

强度信号建议
+8以上🟢 强烈看涨积极做多
+5~+7🟡 温和看涨轻仓试多
+2~+4🔵 轻微看涨观望
-1~+1⚪ 中性不操作
-2~-4🟠 轻微看跌轻仓试空
-5以下🔴 强烈看跌不做多

跨交易所对比

使用 cross_exchange.py 检测 OKX vs Binance 价差,超过0.1%提示套利机会。

风险控制规则

  1. 单笔交易风险 ≤ 账户2%
  2. 总持仓 ≤ 账户50%
  3. 永远带止损
  4. 恐惧&贪婪指数 ≥ 75(极度贪婪)时不做多
  5. 巨鲸净卖出 + RSI超买 → 谨慎
  6. 极度恐惧(≤25)时 ≠ 立即买入,等企稳

配置文件

复制 .env.example.env 后填入:

OKX_API_KEY=your-key
OKX_API_SECRET=your-secret
OKX_API_PASSPHRASE=your-passphrase

注意:balance_check.py 需要三个要素(Key + Secret + Passphrase),缺一不可。

依赖

pip install requests pandas numpy python-dotenv akshare

Comments

Loading comments...