call coinank openapi to get data

This skill appears coherent: it needs your CoinAnk API key to call CoinAnk endpoints and uses only the included OpenAPI specs. Before installing, confirm you trust coinank.com and that the API key you provide has only the necessary read privileges (avoid providing a more-privileged key). Consider rotating the key if you stop using the skill. Because the skill can make network requests to the CoinAnk domain, do not supply high-privilege or multi-service credentials; verify any returned data before acting on it.

Type: OpenClaw Skill Name: coinank-openapi-skill Version: 1.0.0 The skill bundle is classified as suspicious due to a high risk of shell injection vulnerability. The `SKILL.md` explicitly instructs the AI agent to "使用 curl 执行请求" (execute request using curl). While the target domain `https://open-api.coinank.com` is whitelisted, many API parameters defined in the `references/*.openapi.json` files are user-controlled strings (e.g., `symbol`, `exchange`, `interval`, `sortBy`, `amount`, `search`). If the AI agent constructs the `curl` command by directly interpolating these user-controlled inputs without proper shell escaping, an attacker could inject arbitrary shell commands, leading to remote code execution on the host system. This represents a critical vulnerability, even though the skill bundle itself does not contain explicit malicious payloads.