A股-加密货币-定时早报-多维度指标全方位分析-安装即用无复杂配置-自带验证降低幻觉
Analysis
No malicious behavior is evident; this is a disclosed market-analysis skill, but running its helper scripts installs Python packages, contacts public market APIs, and can use an optional CryptoPanic token.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
Crypto via ccxt binanceusdm: ticker/ohlcv/orderbook/trades/funding/OI ... A-share via akshare
The skill discloses that helper scripts contact external market-data providers; this is purpose-aligned, but users should know their symbol/date queries may leave the machine.
subprocess.check_call([str(py), "-m", "pip", "install", "-U", "pip"]) subprocess.check_call([str(py), "-m", "pip", "install", "-r", str(req)])
The optional bootstrap script installs Python tooling and dependencies; this is expected for the data-fetch helpers, but it runs package-install commands from the local environment.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
token = os.getenv("CRYPTOPANIC_TOKEN")
if token:
... data["news"] = fetch_cryptopanic(token, _base_symbol(normalized_symbol))If a CryptoPanic token is present in the environment, the crypto fetch helper can use it to retrieve news; this is disclosed and purpose-aligned, but it is still credential use.