Crypto Kline BTC加密货币K线数据

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: crypto-kline-okx Version: 1.0.0 The skill bundle is a legitimate utility for fetching public cryptocurrency K-line data from the OKX exchange. The Node.js script (scripts/okx-kline.js) uses standard built-in modules (http/https), contains no external dependencies, and does not require or handle sensitive API keys. It includes standard proxy support via environment variables and lacks any indicators of data exfiltration, malicious execution, or prompt injection.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

It may be harder to verify the author's original source or update history.

Why it was flagged

The skill has limited provenance metadata, so users cannot compare it against an upstream project or homepage, though the included code is small and reviewable.

Skill content

Source: unknown; Homepage: none

Recommendation

Review the included script before use, especially if provenance matters for your environment.

Note

ASI07: Insecure Inter-Agent Communication

What this means

OKX, or a configured proxy, can see the trading pair, interval, and timestamp range being requested.

Why it was flagged

The script sends market-data queries to OKX and can route them through a configured proxy; this is disclosed and purpose-aligned, but it is still an external data flow.

Skill content

const BASE_URL = 'www.okx.com'; const BASE_PATH = '/api/v5/market/history-candles'; ... const proxy = process.env.http_proxy || process.env.https_proxy || process.env.HTTP_PROXY || process.env.HTTPS_PROXY;

Recommendation

Use it only if you are comfortable sending those market-data queries externally; unset proxy variables if you do not want a proxy involved.