Crypto Analytics
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code, network calls, caching, and optional API-key usage are coherent with its stated purpose (multi-chain blockchain analytics); nothing appears disproportionate or secretly exfiltrating data.
This skill appears to do exactly what it claims: query public blockchain APIs and cache responses locally. Things to consider before installing: (1) cached responses (addresses, tx hashes) are stored under ~/.openclaw/cache/crypto-analytics and persist for ~5 minutes — delete the folder if you want to remove local traces; (2) providing ETHERSCAN_API_KEY or BLOCKCHAIR_API_KEY increases rate limits but gives the skill access to those API keys — only set keys you trust; (3) minor inconsistencies exist (metadata version mismatch and the .env loading fallback may load a .env in the skill directory if a workspace root isn't found) — these are not malicious but worth noting if you audit the environment. If you need higher assurance, review the full scripts (crypto_api.py, crypto_analytics.py) locally before use.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.