Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Binance Monitor

v1.0.0

实时监控币安官方公告和 @binance、@binancezh 两个 X 账号动态,检测新内容后即时通过飞书通知用户。

0· 290·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xuhaoting/binance-announce-monitor.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Binance Monitor" (xuhaoting/binance-announce-monitor) from ClawHub.
Skill page: https://clawhub.ai/xuhaoting/binance-announce-monitor
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install xuhaoting/binance-announce-monitor

ClawHub CLI

Package manager switcher

npx clawhub@latest install binance-announce-monitor
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's stated purpose (monitor Binance announcements and X accounts and notify via Feishu) is mostly reflected in the code: monitor.js and x-monitor.js fetch public Binance and Jina.ai endpoints and queue notifications. However, the code does NOT implement sending to Feishu (no Feishu API calls or credential usage) and does not read the provided config.json — it uses hard-coded CONFIG objects. The presence of editable config.json and SKILL.md guidance implying an out-of-the-box Feishu integration is therefore misleading.
!
Instruction Scope
SKILL.md instructs users to edit config.json and expects Feishu notifications. In practice monitor.js and x-monitor.js use hard-coded configuration and only write local notify/state files. The sender process only prints NOTIFY:<JSON> to stdout for an external tool to pick up; there are no instructions in the code to send network requests to Feishu or to read environment secrets. This is scope confusion (monitoring is fine; sending relies on external wiring).
Install Mechanism
No install spec; the package is instruction + code only and requires Node >=18. No remote downloads or extract operations are present. Risk is low from installation perspective, but the code writes persistent state files in the working directory (expected).
!
Credentials
The skill declares no required environment variables or credentials, yet its documented behavior (sending Feishu messages) would normally require Feishu credentials/tokens and/or an external 'message' tool. The absence of credential requirements is inconsistent with the claimed notification capability and could mislead users into thinking it will send messages automatically.
Persistence & Privilege
The skill is not force-included (always:false), doesn't request elevated system privileges, and only persists local state/queue files within its directory. It does not modify other skills or system-wide configs.
What to consider before installing
What to consider before installing: - The monitors work: monitor.js polls Binance and x-monitor.js polls Jina.ai for X content and write local state and notify files. - BUT: the project does not actually send Feishu messages. sender.js emits NOTIFY:<JSON> to stdout for an external process to consume — there is no Feishu API call or token handling in the code. If you expect automatic Feishu delivery, you must provide or implement a delivery component which holds your Feishu credentials. - The SKILL.md and README tell you to edit config.json, but the runtime scripts use hard-coded CONFIG objects and do not read config.json. If you need different intervals/targets, update the code or add config-loading logic. - There are no requested environment variables; that means secret handling is left to you. Do not store secrets in the repo; prefer environment variables or secure storage. - Safe usage tips: run in an isolated directory or container, inspect and (if needed) modify the code to add proper config parsing and a secure Feishu sender that reads credentials from environment variables, test end-to-end in a controlled environment, and verify that the external delivery component handles retries and rate limits. - If you want this skill to automatically send messages via OpenClaw/OpenClaw agents, confirm how OpenClaw captures sender.js stdout and whether it provides secure credential injection. If uncertain, treat the skill as -> monitoring + local queue only until you wire a secure sender.

Like a lobster shell, security has layers — review code before you run it.

latestvk9781txr7qsd1ppngyy5nb440d82r1fj
290downloads
0stars
1versions
Updated 6h ago
v1.0.0
MIT-0

Binance Announce Monitor - 币安公告 + X 账号监控技能

实时监控币安(Binance)官方公告和 X 账号动态,检测到新内容时立即通过飞书通知用户。

功能

  • 🔍 实时监控 - 公告 API 每 30 秒检查,X 账号每分钟检查
  • 📬 即时通知 - 检测到新动态立即发送飞书消息
  • 📝 内容摘要 - 自动提取公告/推文内容
  • 🐦 X 账号监控 - 监控 @binance 和 @binancezh 两个官方账号
  • 💾 状态持久化 - 记录已读动态,避免重复通知
  • 自动运行 - 后台持续监控,无需人工干预

使用场景

  • 币安上币/下架公告第一时间获知
  • 合约调整、交易规则变更及时知晓
  • 系统维护、API 变更提前准备
  • 空投、活动公告不错过
  • 🐦 币安 X 账号(@binance、@binancezh)最新动态

安装

# 技能已内置,无需额外安装
# 确保 Node.js 18+ 已安装

配置

编辑 config.json(可选,使用默认值可跳过):

{
  "checkIntervalSeconds": 30,
  "targetUser": "ou_xxxxxxxxxxxxxx",
  "channel": "feishu"
}
参数默认值说明
checkIntervalSeconds30检查间隔(秒)
targetUser当前用户通知接收者 open_id
channelfeishu通知渠道

使用方法

启动监控

cd skills/binance-announce-monitor
node monitor.js

后台运行(推荐)

# 使用 nohup
nohup node monitor.js > monitor.log 2>&1 &

# 或使用 screen
screen -S binance-monitor
node monitor.js
# Ctrl+A, D 退出屏幕

# 或使用 systemd(生产环境)
sudo systemctl enable binance-monitor
sudo systemctl start binance-monitor

查看状态

# 查看运行日志
tail -f monitor.log

# 查看已读公告记录
cat binance-announce-state.json

# 查看待发送通知
cat binance-pending-notify.json

停止监控

# 找到进程
ps aux | grep binance-monitor

# 停止
kill <PID>

# 或如果使用 screen
screen -r binance-monitor
# Ctrl+C

通知格式

📢 **币安新公告**

**{公告标题}**

{公告摘要}

👉 [查看详情](https://www.binance.com/en/support/announcement/{id})

文件说明

文件说明
monitor.js主监控脚本
sender.js通知发送器(可选,独立部署)
config.json配置文件(可选)
binance-announce-state.json已读公告状态(自动生成)
binance-pending-notify.json待发送通知队列(自动生成)
binance-sent-ids.json已发送记录(自动生成)

API 来源

  • 币安公告 API: https://www.binance.com/bapi/composite/v1/public/cms/article/list/query
  • 公告分类 ID: 48(最新公告)
  • 请求频率: 每 30 秒一次(安全范围内)

注意事项

  1. 不要设置过短的检查间隔 - 低于 10 秒可能触发 API 限流
  2. 保持脚本运行 - 停止后会错过期间的公告
  3. 定期清理状态文件 - 避免文件过大(脚本自动保留最近 100 条)
  4. 网络要求 - 需要能访问 www.binance.com

扩展

添加其他交易所

复制 monitor.js 并修改 API URL:

// 示例:OKX 公告
const OKX_ANNOUNCE_URL = 'https://www.okx.com/api/v5/support/announcements';

// 示例:Bybit 公告
const BYBIT_ANNOUNCE_URL = 'https://api.bybit.com/spot/v1/announcement';

添加其他通知渠道

修改 queueNotification 函数,支持:

  • Telegram Bot
  • Discord Webhook
  • 微信企业机器人
  • 邮件通知

多用户支持

config.json 中添加用户列表:

{
  "users": [
    {"id": "ou_xxx1", "channel": "feishu"},
    {"id": "ou_xxx2", "channel": "telegram"}
  ]
}

故障排除

无法获取公告

# 测试 API 连通性
curl -s "https://www.binance.com/bapi/composite/v1/public/cms/article/list/query?type=1&pageNo=1&pageSize=5&catalogId=48" | head

通知未发送

# 检查通知队列
cat binance-pending-notify.json

# 检查已发送记录
cat binance-sent-ids.json

# 查看日志
tail -f monitor.log

重复通知

删除状态文件重置:

rm binance-announce-state.json
rm binance-sent-ids.json

版本历史

  • 1.0.0 - 初始版本,支持币安公告监控 + 飞书通知

许可证

MIT

贡献

欢迎提交 Issue 和 PR!


作者: OpenClaw Community
最后更新: 2026-03-12

Comments

Loading comments...