TradingView技术指标分析助手
v1.0.6通过调用Prana平台上的远程 agent 执行 TradingView 技术指标相关的分析与计算，并将结果返回给调用方
⭐ 0· 115·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description state that remote Prana agents will perform TradingView indicator analysis; the skill only requires PRANA_SKILL_API_FLAG and calls prana.chat endpoints (agent-run, agent-result, api-keys, skill-purchase-history-url), which is coherent and proportionate to that purpose. Minor nit: skill.json uses duplicated slashes in some URLs (https://www.prana.chat//api/...), but this is likely syntactic and not a capability mismatch.
Instruction Scope
SKILL.md confines runtime behavior to obtaining/using a PRANA_SKILL_API_FLAG and calling prana.chat APIs. It does not instruct reading unrelated files or other credentials. It does instruct writing a persistent OpenClaw environment variable and contains an admonition to confirm with the user before obtaining the key — that user-consent requirement is somewhat ambiguous in practice (the doc both tells the agent how to fetch and how to set the global env var), so operators should ensure the agent actually prompts for consent before making changes.
Install Mechanism
Instruction-only skill; no install spec and no code files, so nothing is downloaded or written beyond the described environment-variable update.
Credentials
The skill requests exactly one environment variable (PRANA_SKILL_API_FLAG) which is appropriate for authenticating to prana.chat. Two points to be aware of: (1) the SKILL.md instructs generating this key via an unauthenticated GET /api/v2/api-keys call — the doc states this returns a user-specific token, but you should verify the token's scope/validity before trusting it; (2) the skill asks to persist the key globally via 'openclaw config set env...', which stores the credential persistently and could have cost/usage implications if the key is shared or long-lived.
Persistence & Privilege
The skill is not always-included and does not request elevated platform privileges. However, it instructs writing a global persistent environment variable (PRANA_SKILL_API_FLAG) into the OpenClaw config; that is a lasting change and should only be done with explicit user consent. Autonomous invocation remains allowed by platform defaults (not a new concern here).
Assessment
This skill appears to do what it says: forward TradingView indicator queries to a Prana remote agent. Before installing or running it, confirm you are comfortable with the following: (1) requests and any user-provided queries will be sent to https://www.prana.chat — review Prana's privacy and terms and verify the domain; (2) the skill will persist a PRANA_SKILL_API_FLAG in OpenClaw's global config if not already present — ensure you consent to storing that token and understand its lifetime and scope; (3) verify how the api_key is generated (the skill says GET /api/v2/api-keys is unauthenticated) so you know whether the returned token is truly user-specific and what it authorizes; (4) do not include any sensitive credentials or account data in user queries (the SKILL.md reiterates this); and (5) consider revoking the stored PRANA key when you no longer need the skill. Require the agent to explicitly prompt for user permission before fetching or setting the environment variable.Like a lobster shell, security has layers — review code before you run it.
latestvk9758d3na51prq0bm1jab7jxch83zry3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.