Crypto Market Analyzer

Fetch real-time crypto prices and calculate technical indicators (SMA, EMA, MACD, RSI, Bollinger Bands, ATR) for BTC, ETH, SOL, BNB, XRP, DOGE. Powered by mu...

Security Scan

The skill mostly matches its stated purpose (fetch prices + indicators) but contains inconsistencies around billing (a hard-coded API key/default SKILL_ID and a zero charge amount) that are unexplained and warrant caution.

Purpose & Capability

Name/description (market data + indicators) align with the included scripts: fetch_market.py and calc_indicators.py implement the advertised features. The requirement for billing-related env vars (SKILL_BILLING_API_KEY, SKILL_ID) is consistent with the SKILL.md's pay-per-use claim.

Instruction Scope

SKILL.md and the scripts instruct running the Python scripts and passing --user for billing. However, the billing behavior in the code contradicts the docs (see billing amount), and billing.py contains an embedded default API key and default SKILL_ID. Instructions ask to pass user IDs and may surface payment_url links — otherwise the runtime actions are limited to public API requests, which is appropriate for the stated purpose.

Install Mechanism

No install spec (instruction-only install) and no downloads; scripts are plain Python and call only public web APIs. This is low risk from an install mechanism perspective.

Credentials

Declared env vars (SKILL_BILLING_API_KEY, SKILL_ID) are proportionate to a pay-per-use skill, but billing.py embeds a default API key and a default SKILL_ID value. Hard-coded credentials in the repository are a security concern and inconsistent with expecting callers to provide their own keys.

Persistence & Privilege

Skill is not forced-always and does not request system-level persistence. It does not modify other skills or system settings based on the provided files.

Scan Findings in Context

[hardcoded-api-key] unexpected: scripts/billing.py contains a hard-coded API key-like string (SKILL_BILLING_API_KEY default) and a default SKILL_ID. A billing SDK typically should not embed live keys in source. This is unexpected and could indicate leaked credentials or sloppy packaging.

[billing-amount-mismatch] unexpected: SKILL.md and README state a cost per invocation (0.001 USDT / 1 token), but charge_user in scripts/billing.py posts amount: 0 when charging. This inconsistency may be a bug or intentional (no charge), and should be clarified before trusting production billing behavior.

What to consider before installing

This skill appears to implement the advertised crypto data and indicator functions, but exercise caution before installing or wiring real billing keys. Key points to consider: - Hard-coded credential: billing.py includes a default API key and SKILL_ID in source. Treat this as a potential secret leak or placeholder; do not assume it is safe to use. Prefer providing your own SKILL_BILLING_API_KEY and rotate any exposed keys. - Billing inconsistency: the documentation claims 0.001 USDT per call, but the charge function sends amount: 0. Ask the publisher which behavior is intended — you should not rely on embedded defaults for real billing. - Test-mode: use the provided --test-mode flag to exercise the scripts before adding real billing credentials or enabling the skill for real users. - Network access: the scripts make outbound requests to several public crypto APIs (Binance, CoinGecko, CoinCap, CryptoCompare) and to https://skillpay.me for billing. If you require strict network policies, review these endpoints. - Verification: because the source owner is 'unknown' and the package includes a hard-coded key, prefer installing only after verifying the publisher (homepage, repo, signatures) or reviewing the code locally and removing any embedded secrets. If you want, I can: (1) flag the exact lines with the hard-coded key and SKILL_ID for removal; (2) produce a suggested patch to remove defaults and make billing explicit; or (3) run a deeper code-consistency checklist to identify other subtle mismatches.

This skill provides two core capabilities for cryptocurrency analysis:

1. Real-time Market Data — Get current prices, 24h changes, volume, and highs/lows
2. Technical Indicator Analysis — Calculate professional-grade indicators with trading signals

Supported Coins

BTC, ETH, SOL, BNB, XRP, DOGE

Dependencies

The scripts require the requests Python library. Install it if not available:

pip install requests

Billing

This is a paid skill. Each invocation costs 0.001 USDT, charged via SkillPay. Pass the --user flag with the user's ID for billing. If the user's balance is low, the script will return a payment_url — present this link to the user.

---

Command 1: Fetch Market Data

When to use: When the user asks about current crypto prices, market conditions, or needs real-time price data.

Get Current Prices

python scripts/fetch_market.py --user USER_ID --coins BTC,ETH,SOL

Parameters:

• --coins (required): Comma-separated coin symbols (e.g. BTC,ETH,SOL)
• --user (required): User ID for billing
• --test-mode (optional): Skip billing for testing

Output format (JSON):

{
  "status": "success",
  "data": {
    "BTC": {
      "price": 95432.10,
      "change_24h": 2.35,
      "high_24h": 96000.00,
      "low_24h": 93800.50,
      "volume_24h": 28500000000,
      "source": "binance"
    }
  },
  "coins_requested": ["BTC"],
  "timestamp": 1709654321
}

Get Historical Prices

python scripts/fetch_market.py --user USER_ID --coins BTC --historical --days 30

Additional parameters:

• --historical: Enable historical mode
• --days (default 30): Number of days of history

Output includes OHLCV data (open, high, low, close, volume) for each time period.

---

Command 2: Technical Indicator Analysis

When to use: When the user asks about technical analysis, trading signals, trend analysis, support/resistance levels, or whether to buy/sell a coin.

python scripts/calc_indicators.py --user USER_ID --coin BTC --days 30

Parameters:

• --coin (required): Single coin symbol (e.g. BTC)
• --days (default 30): Days of data for analysis
• --user (required): User ID for billing
• --test-mode (optional): Skip billing for testing

Output format (JSON):

{
  "status": "success",
  "coin": "BTC",
  "current_price": 95432.10,
  "moving_averages": {
    "sma_7": 94800.50,
    "sma_14": 93200.30,
    "sma_30": 91500.00,
    "ema_12": 94600.80,
    "ema_26": 93100.20
  },
  "macd": {
    "macd_line": 1500.60,
    "signal_line": 1200.30,
    "histogram": 300.30
  },
  "rsi_14": 62.5,
  "bollinger_bands": {
    "upper": 97000.00,
    "middle": 93200.00,
    "lower": 89400.00,
    "bandwidth": 8.15,
    "position": 0.79
  },
  "atr_14": 1850.30,
  "momentum": {
    "change_7d_pct": 3.25,
    "change_30d_pct": 8.50
  },
  "volatility_pct": 2.15,
  "support_resistance": {
    "support": 89400.00,
    "resistance": 97000.00
  },
  "signals": [
    "RSI leaning bullish",
    "MACD bullish crossover → BUY signal",
    "Uptrend: Price & SMA7 above SMA30"
  ],
  "signal_score": 45,
  "overall_assessment": "STRONG BUY"
}

Interpreting the Output

When presenting results to the user, focus on these key elements:

For Market Data:

• Price and 24h change are the most important
• Mention volume for context on market activity
• Flag if change_24h is extreme (> ±5%)

For Technical Analysis:

• overall_assessment gives the summary: STRONG BUY / BUY / NEUTRAL / SELL / STRONG SELL
• signal_score ranges from -100 (extremely bearish) to +100 (extremely bullish)
• signals array lists the specific reasons behind the assessment
• RSI: <30 = oversold (buy opportunity), >70 = overbought (sell opportunity)
• MACD histogram > 0 = bullish momentum, < 0 = bearish momentum
• Bollinger Band position: <0.1 = near support, >0.9 = near resistance

Important Disclaimer:

Always remind users that technical indicators are for educational/analysis purposes only and do not constitute financial advice. Cryptocurrency markets are highly volatile.

Error Handling

If a script returns an error, check:

1. Payment error — Present the payment_url to the user to top up balance
2. Data source error — All APIs failed; suggest trying again in a few minutes
3. Invalid coin — List the supported coins: BTC, ETH, SOL, BNB, XRP, DOGE