Crypto Funding Alert

Real-time crypto funding rate scanner with smart alerts. Finds negative funding rates for profitable long positions. Supports Binance futures. No API key nee...

Install only if you treat this as an informational market scanner, not an automated trading advisor. Review the code before using the recommendations, avoid passing unsafe leverage or stop-loss values, be aware it saves scan history locally by default, and do not enable webhook examples unless you are comfortable sending the output to that service.

Type: OpenClaw Skill Name: crypto-funding-alert Version: 1.0.1 The skill is classified as suspicious due to a potential uncontrolled file write vulnerability in `scan.js`. While the default data storage path is safe (`~/.openclaw/workspace/data/funding-monitor/scan_history.jsonl`), the `--output <path>` command-line argument allows writing the `scan_history.jsonl` file to an arbitrary directory. Although `path.join` is used, which mitigates simple path traversal, it still permits writing to any location the process has permissions for. This could be exploited by an attacker to write files to sensitive system directories if they can control the arguments passed to `scan.js`, leading to potential denial of service or other impacts. There is no evidence of intentional malicious behavior like data exfiltration or remote code execution within the provided code or prompt instructions.