A股-加密货币-定时早报-多维度指标全方位分析-安装即用无复杂配置-自带验证降低幻觉

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Running the helpers will contact third-party market-data services and may reveal which symbols or markets the user queried.

Why it was flagged

The helper scripts make outbound market-data API calls using user-supplied symbols. This is expected for a market-analysis skill, and the artifacts do not show account mutation or trading actions.

Skill content

ex = ccxt.binanceusdm({"enableRateLimit": True}) ... ex.fetch_ticker(normalized_symbol) ... ex.fetch_l2_order_book(normalized_symbol, limit=100)

Recommendation

Run the scripts only for intended symbols and rely on the documented public data sources; do not treat generated analysis as an automated trading instruction.

Note

ASI03: Identity and Privilege Abuse

What this means

If provided, the CryptoPanic token will be used to call the news provider and could be exposed if the user pastes it into chat or logs it elsewhere.

Why it was flagged

The skill can use an optional CryptoPanic API token for news. This is disclosed and purpose-aligned, but it is still credential use that users should handle carefully.

Skill content

parser.add_argument("--token", help="CryptoPanic token (optional if env set)") ... token = args.token or os.getenv("CRYPTOPANIC_TOKEN")

Recommendation

Provide the token only when news is needed, prefer environment variables over chat messages, and rotate the token if it is accidentally shared.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing dependencies runs package installation code from external package sources in the user's environment.

Why it was flagged

The optional bootstrap installs Python dependencies. This is a standard, user-directed setup step and the requirements file pins package versions, but it still introduces third-party package supply-chain exposure.

Skill content

subprocess.check_call([str(py), "-m", "pip", "install", "-U", "pip"])
subprocess.check_call([str(py), "-m", "pip", "install", "-r", str(req)])

Recommendation

Use the provided virtual environment workflow, review the pinned requirements, and install only from trusted package indexes.