Security Defense Line 安全防线

安全防线 - 全方位安全防护与威胁防御系统。 当用户需要以下功能时触发此skill： (1) 智能合约安全审计与漏洞检测 (2) 钱包安全检测与防护 (3) 交易安全验证与风险预警 (4) 钓鱼网站/诈骗检测 (5) 私钥/助记词安全管理 (6) 多签钱包配置与管理 (7) 安全事件响应与应急处理 (8) 安全策...

This skill appears to implement the security features it advertises, but there are several red flags you should consider before installing or running it: - Hardcoded billing credential: payment.py contains a cleartext BILLING_API_KEY and calls https://skillpay.me. Hardcoded keys are insecure and could allow unexpected charges or leak sensitive billing access. Ask the author to remove the embedded key and require a runtime environment variable instead. - Undeclared environment secrets: SKILL.md and code reference TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, and SKILLPAY_USER_ID but the skill metadata lists no required env vars. Running the skill may prompt you to provide these secrets or try to operate without them. - External binaries and network access: scripts expect to call tools like Slither/Mythril and will reach external endpoints. Ensure those binaries are installed from trusted sources, and run the skill in an isolated environment (container/VM) first. - Long‑running and local monitoring behavior: the monitor and phishing scripts can run as daemons, open a web dashboard, and watch the clipboard. Only run this code in an environment where you permit network egress and local input monitoring; do not run on a machine holding real private keys. - Billing and payment flow: the skill enforces a payment check at startup (require_payment) and may attempt to charge a user id it finds in the environment. Verify the billing provider (skillpay.me) and the legal/financial implications before using. Recommended actions before use: - Request the author to remove embedded API keys and to document required env vars explicitly. - Review all scripts fully (especially omitted/truncated parts) for any outbound network calls or data exfiltration paths. - Run the skill in a sandbox (container or ephemeral VM) with no access to your private keys or sensitive files; restrict network egress if possible and inspect outbound traffic. - If you need only audit functionality, consider using well‑known, audited tools (Slither/Mythril/OpenZeppelin) directly rather than an unvetted bundle. If you provide the full remaining files (truncated parts) or confirm the intended billing workflow and env var list, I can raise or lower the confidence of this assessment.