Family Crypto Explainer

A plain-language explanation helper for talking to family members about crypto involvement. Use when discussing crypto with non-crypto people. Prompt-only.

Security Scan

The SKILL.md is a simple, prompt-only family-crypto helper, but the included handler.py contains a hard-coded user path that reads files from the local disk — an unexplained mismatch that could access user data.

Purpose & Capability

The skill description and SKILL.md describe a prompt-only explanation helper that needs no files or credentials. However, handler.py contains _load_skill_meta which opens a hard-coded path (/Users/jianghaidong/.openclaw/skills/{skill_name}) and reads SKILL.md from the local filesystem. A prompt-only explainershould not need to access a specific user's home directory; this is disproportionate and unexplained (likely a leftover dev path or a covert local-read).

Instruction Scope

The SKILL.md instructions are scoped to the stated purpose: ask about the family member, identify concerns, translate concepts, and produce a concise output format. The markdown itself does not instruct the agent to read files, call external endpoints, or access environment variables.

Install Mechanism

There is no install spec (instruction-only), which is low risk. However, the package includes code files (handler.py). Although no installer downloads remote artifacts, the presence of handler.py means code will run when the skill is invoked and can perform local I/O — this increases the attack surface compared with a pure prompt-only skill.

Credentials

The registry declares no required environment variables or credentials, which matches the described purpose. Nonetheless, handler.py accesses a local path that could expose other skill files or sensitive local data. The file access is not declared or justified by the skill's purpose and is therefore disproportionate.

Persistence & Privilege

The skill does not request always:true and is user-invocable only (normal). There is no evidence it modifies other skills or system settings. The remaining concern is local-file reading by the handler when invoked, which increases potential data exposure but is not a persistence/privilege escalation flag by itself.

What to consider before installing

The SKILL.md is benign and self-contained, but handler.py reads a hard-coded user path (/Users/jianghaidong/.openclaw/skills/{skill_name}) — unexpected for a prompt-only helper. This could expose local files or other skills. Before installing or enabling: 1) ask the publisher why the handler reads a hard-coded home path and request its removal or change to a safe pattern; 2) inspect or remove handler.py (if you only need the prompt) or run the code in a sandboxed environment; 3) if you keep the code, change the path to a safe, configurable location or ensure it only reads files explicitly provided by the platform API; 4) avoid installing if you cannot verify the author's identity or the reason for local file access. If you want, I can suggest an edited handler.py that removes the hard-coded path and only uses passed-in inputs.

A plain-language explanation helper for talking to family members about crypto involvement.

Workflow

1. Ask who the family member is, their age, financial background, and what prompted the conversation.
2. Identify the core concern: safety, legitimacy, environmental impact, financial risk, or something else.
3. Translate the crypto concept into a frame the family member already understands.
4. Address the specific concern directly, honestly, and without hype.
5. Give a recommendation on how to continue the conversation.

Output Format

• Key concern identified
• Translation in their language
• Honest assessment of the concern
• What you would tell them about your own position
• Suggested closing line for the conversation

Quality Bar

• Respects the family member's skepticism as valid.
• Does not oversell or defend crypto aggressively.
• Honest about risks and uncertainties.

Edge Cases

• If the family member is elderly or has no financial buffer, lean toward conservative framing.
• If the family member has been scammed before, take extra care with any language that sounds like a pitch.

Compatibility

• Prompt-only, works from brief descriptions of the situation.
• Good companion to scam red flags and wallet safety skills.