Skillv1.0.3

ClawScan security

Binance Crypto Price · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 5, 2026, 6:28 AM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's files and runtime instructions match its description: it queries Binance's public ticker endpoint for prices, requires no credentials, and does not perform unexpected operations.
Guidance: The skill appears coherent and only queries the public Binance API, but its source is unknown. Before installing or running: (1) review the included script (you can see it in scripts/cryptoprice.py) and confirm it matches expectations, (2) run it in a restricted environment or sandbox if you are cautious, (3) install the requests library from a trusted source (pip install requests), and (4) if you need stronger assurance, ask the publisher for a homepage or source repository and verify checksums or a signed release. Note: no API keys are required and the skill does not request or store secrets.

Purpose & Capability: okName/description (Binance price queries) align with the included script and SKILL.md. The script only calls Binance public API endpoints and formats output for single or multiple symbols.
Instruction Scope: okSKILL.md directs running the included script and the script only performs HTTP GETs to the Binance API and prints results; it does not read local files, access other services, or exfiltrate data.
Install Mechanism: noteThere is no install spec (instruction-only), which is low risk. The shipped script declares a dependency on requests (commented and enforced at runtime). No remote downloads, archive extraction, or unusual install steps are present.
Credentials: okNo environment variables, credentials, or config paths are requested. The skill does not require keys or tokens to query Binance public endpoints.
Persistence & Privilege: okSkill is not always-enabled and is user-invocable. It does not attempt to modify other skills or system-wide configuration.