Signalbot

量化行情分析工具，对 BTC、黄金（XAUUSD）等标的计算 10 类技术指标（RSI、MACD、布林带、EMA、ATR、成交量、顾比均线、斐波那契回撤、锚定 VWAP、固定范围成交量分布），输出结构化 JSON 行情报告，可据此生成行情分析推文或做出操作建议。同时支持 1h/4h/日/周/月 多周期综合分析。

What to consider before installing: - Review the upstream GitHub repository (https://github.com/shanhuhai5739/signalbot) and prefer a tagged/verified release rather than @latest. Look at recent commits, contributors, and issues. - Do not allow the agent to run the automatic install without review. The SKILL.md explicitly says to run `go install ...` automatically — this will fetch and compile arbitrary code from the network and place a binary on disk. - If you decide to install, run the install manually in a controlled environment first (e.g., local sandbox or VM), inspect the source or the built binary, and avoid running as root. Consider building from a specific commit tag or release and pinning the version. - Be cautious about following instructions that copy the binary into /usr/local/bin or add cron jobs; those steps require elevated permissions and create persistence. If you need scheduled runs, prefer platform-level scheduling you control or review the cron job contents before enabling. - If you need network isolation, run the binary with restricted network access or point BINANCE_BASE_URL to a trusted proxy. Prefer to provide only the minimum configuration required and avoid exposing credentials. - If you want higher assurance, ask the maintainer for signed releases, reproducible build info, or a checksum for the release binaries before installing.

Type: OpenClaw Skill Name: signalbot Version: 1.1.0 The skill provides quantitative financial analysis but contains instructions in `SKILL.md` directing the AI agent to automatically install a remote Go package (`github.com/shanhuhai5739/signalbot@latest`) without user confirmation if the binary is missing. While intended for convenience, this 'auto-provisioning' behavior bypasses user consent for remote code execution and introduces a supply-chain risk. No evidence of data exfiltration or intentional malice was found in the provided logic.