Token Risk Explainer

Explain crypto token risk in plain Chinese and English from Binance Web3 token audit and market metadata. Use this skill when users want a contract-level ris...

This skill otherwise looks coherent with its stated purpose, but be aware of these practical issues before installing: 1) Billing: by default the code uses a SkillPay billing client and will try to read SKILLPAY_APIKEY; if SKILLPAY_APIKEY is not set and SKILLPAY_BILLING_MODE is not set to 'noop' the skill will raise an error when it tries to bill. SKILL.md mentions SKILLPAY_APIKEY and SKILLPAY_PRICE_USDT but the registry metadata lists no required environment variables — treat that as a mismatch. 2) Network endpoints: the skill calls https://web3.binance.com (or whatever you set via BINANCE_WEB3_BASE_URL) to fetch token audits/meta and may call the SkillPay service (default https://skillpay.me) for billing. The data sent includes contract addresses and token metadata/audit results (not private keys), but it is transmitted to external services. 3) If you want to test safely, run the scripts in a sandbox and either (a) set SKILLPAY_BILLING_MODE=noop or (b) run with a known test SKILLPAY_APIKEY and SKILLPAY_BASE_URL pointed to a test endpoint. 4) If you require a guarantee that no billing/telemetry occurs, inspect or modify build_billing_client/maybe_bill to force noop billing. 5) The code is readable and doesn't request private wallet keys, but the environment var mismatch and implicit billing behavior are the main risks; if you rely on the registry metadata alone you could encounter runtime errors or unexpected external billing calls. If you want higher assurance, ask the author to update the declared required env vars and to document the CLI flags (e.g., --skip-billing) explicitly.

Type: OpenClaw Skill Name: token-risk-explainer-skill Version: 0.1.0 The token-risk-explainer-skill is a legitimate tool designed to analyze and report on cryptocurrency token risks using Binance Web3 API data. The codebase, including scripts/token_risk_explainer.py and scripts/web3_client.py, follows standard practices for API interaction, data processing, and risk scoring. While it includes a billing module (scripts/billing.py) that requires an API key (SKILLPAY_APIKEY), this is transparently documented and used solely for its stated purpose of processing usage charges. No evidence of data exfiltration, malicious execution, or prompt injection was found.