DEX Price Monitor DEX价格监控

DEX价格监控与差价追踪助手。当用户需要实时监控多个DEX的代币价格、发现套利价差、设置价格预警、分析价格趋势或获取最优交易路径时使用。支持Uniswap、SushiSwap、Curve等主流DEX，涵盖以太坊、Arbitrum、BSC等多链生态的价格监控。

This skill otherwise looks like a legitimate DEX price-monitoring toolkit, but stop and verify before installing or running it. Specific things to check: 1) Billing: SKILL.md and _meta.json indicate per-call billing; payment.py will attempt to charge via skillpay.me. Confirm the billing provider is trustworthy and that you consent to automatic per-call charges. 2) Embedded secret: payment.py includes a hard-coded billing API key — ask the author to remove it and to use an explicitly declared environment variable instead. 3) Environment variables: the skill references many secrets (Telegram bot tokens, email SMTP credentials, webhook URLs, SkillPay user id/key) but the registry listing omitted required env declarations; ensure you never paste sensitive credentials into an untrusted skill. 4) Local file access: scripts read local config/data files (e.g., load_from_monitor_data), so run in a sandbox or review file paths to avoid accidental disclosure of local data. 5) If you plan to use it, request: (a) removal of hard-coded keys, (b) clear documentation of when payment verification runs, and (c) a minimal reproducible example showing how the skill charges and what user data is sent to the billing API. If the author cannot address these, treat the skill as untrusted and do not run it with real credentials or on production systems.

Type: OpenClaw Skill Name: shenmeng-dex-price-monitor Version: 2025.4.12 The bundle is a functional DEX price monitoring and arbitrage toolset. It includes scripts for real-time price tracking (realtime_monitor.py), historical analysis (historical_analyzer.py), and price alerts (price_alerts.py) via Telegram and Discord webhooks. While it implements a 'pay-per-use' monetization layer (payment.py) that communicates with an external billing API (skillpay.me) and contains a hardcoded developer API key, these behaviors are consistent with the stated commercial purpose of the skill and do not constitute malware. No evidence of data exfiltration, malicious command execution, or prompt injection was found.