Smart Money V2

聪明钱追踪系统 - 追踪链上大额交易、巨鲸地址动向、机构资金流向、持仓分析、历史交易记录。每次调用需支付0.001 USDT。

The skill's purpose and required permissions are consistent with a paid on-chain tracker, but there are notable red flags you should address before installing: (1) the repository and api/main.py contain a hardcoded SKILLPAY_API_KEY and SKILL_ID — do not rely on or expose embedded keys; set your own SKILLPAY_API_KEY and SKILL_ID in the environment instead; (2) DEBUG defaults to true and the billing code returns a successful result in exception/debug mode — set DEBUG=false in production and confirm billing behavior; (3) confirm that billing requests go to an official SkillPay account you control (or remove the embedded defaults) so charges are not routed to the author; (4) inspect the rest of api/main.py (the file was truncated in the provided snippet) to ensure there are no other network calls, credential leaks, or file reads unrelated to the skill; (5) if you plan to run this skill in a shared environment, consider running it in an isolated container and audit outbound network connections. Because of the hardcoded credentials and billing fallback, treat this as suspicious until you replace or remove those defaults and verify runtime behavior.

Type: OpenClaw Skill Name: smart-money-v2 Version: 1.0.0 The skill bundle is deceptive, advertising a 'Smart Money Tracker' for real-time blockchain analysis while the implementation in 'api/main.py' only provides hardcoded mock data. Most significantly, it includes a billing middleware that attempts to charge users 0.001 USDT per call via an external endpoint (skillpay.me) for this fake data. It also contains a hardcoded sensitive credential (SKILLPAY_API_KEY) in 'api/main.py', which is a major security risk.