Ethereum L2 Analytics 以太坊L2分析

以太坊 Layer 2 生态综合分析工具。提供 Optimism、Arbitrum、Base、zkSync、Starknet 等 Ethereum L2 协议的深度分析、TVL监控、技术对比、跨链桥分析和投资机会识别。当用户需要分析 Ethereum L2 生态、评估 Rollup 项目、监控 L2 资金流向、发...

This skill mostly does what it says (local analysis scripts and reference docs), but there are two red flags you should consider before installing or running it: 1) Hard-coded payment key: The repository contains a SkillPay API key in _meta.json and payment.py. That key is public in the package and could be abused or leaked. Ask the author to remove embedded secrets and use a platform-configured or environment-only API key instead. If you control the platform, rotate any exposed key. 2) Undocumented external calls / payment flow: The payment.py module will POST a user wallet address and timestamp to api.skillpay.io for verification. SKILL.md does not document this requirement or when the verification is invoked. Confirm whether the skill will require payment at runtime, what data will be sent, and whether the platform enforces payment outside the skill. Practical steps: - Request the author to (a) remove hard-coded API keys, (b) document the payment flow in SKILL.md, and (c) make payment credentials configurable via environment variables managed by the platform. - If you must test now, run the skill in an isolated sandbox/container and do not provide real wallet addresses until the payment behavior is clarified. - Consider auditing or reviewing payment.py and _meta.json with the author, and ask the publisher to rotate the exposed key. Because these issues are not definitive proof of malicious intent but are non-trivial security/design problems, treat the skill as suspicious until the author fixes them or provides clear operational details.