Wan Crypto Gold Monitor
v1.0.0加密货币与贵金属价格监控 / Crypto & Precious Metals Price Monitor - 监控BTC/ETH实时价格、黄金(XAU)/白银(XAG)走势，免费API无需Key
⭐ 0· 111·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the implementation: the script fetches BTC/ETH from CoinGecko and metals from GoldAPI/Yahoo and shows comparisons/alerts. Minor inconsistencies: SKILL.md declares no required binaries but the script expects curl, python3, bc, stat and standard shell utilities; _meta.json ownerId/slug/version differ from the registry metadata (suggests packaging or provenance inconsistency).
Instruction Scope
Runtime instructions (CLI commands in SKILL.md) map to the provided shell script behavior. The script only reads/writes to /tmp/crypto-monitor for caching/history and calls public price APIs; it does not attempt to read other system files, environment variables, or send data to unexpected endpoints.
Install Mechanism
No install spec — instruction-only with an included script. Nothing is downloaded or executed from remote URLs during install; network calls happen at runtime to well-known public API endpoints.
Credentials
The skill requests no environment variables or credentials. The script uses a demo token header for GoldAPI and public endpoints; no secrets or external credentials are required.
Persistence & Privilege
always is false and the skill does not modify system-level settings or other skills. It stores caches/history under /tmp/crypto-monitor only, which is proportional for a monitoring utility.
Assessment
This skill appears to do what it says: fetch prices from CoinGecko, GoldAPI (demo token), and Yahoo and display cached results. Before installing, consider: 1) The bundled script expects curl, python3 and bc — verify those are present or the script may fail. 2) The script writes caches/history to /tmp/crypto-monitor (non-persistent) — review or remove these files if you care about local clutter. 3) _meta.json owner/version differ from the registry metadata; if provenance matters to you, ask the publisher for clarification or inspect the script yourself. 4) Because the skill makes outbound network requests, run it in a trusted or sandboxed environment if you are cautious. If you want higher assurance, manually review the crypto-monitor.sh contents before running.Like a lobster shell, security has layers — review code before you run it.
latestvk976defm1zctz6hg8sensdj50583fqgr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.