Standx Cli

Crypto trading CLI for StandX exchange v0.3.5. Use when users need to: (1) Query crypto market data (prices, order books, klines, funding rates), (2) Manage...

This skill appears to be what it claims (a CLI for StandX), but check a few things before installing or providing credentials: - Verify the upstream repository and author: review https://github.com/wjllance/standx-cli (or the repo referenced) and confirm releases match the SHA sums in the release notes. Don't run curl|sudo blindly. - Note the version mismatch: many files/scripts reference v0.3.5 while the registry shows 0.5.0. Confirm you are installing the intended version. - Prefer Homebrew only if you trust the 'wjllance' tap. If unsure, clone the repo, inspect sources, and build locally or use a vetted distribution channel. - Treat STANDX_JWT and STANDX_PRIVATE_KEY as sensitive: use ephemeral tokens, keep them in restricted files (chmod 600) or environment variables in a session, and rotate tokens regularly. - Avoid passing credentials on the command line (the SKILL.md warns of this); use file-based or env-var authentication as recommended. - If you must run the installer script, inspect it first and verify the GitHub release tarball contents and digital signature (if provided). Consider installing the binary in a sandbox/container first to test behavior. If you want, I can: (1) help list steps to verify the GitHub release (checksums, tags), (2) show a safe checklist for installing third-party CLI binaries, or (3) fetch the repo metadata to compare versions if you provide the repo URL to inspect.

Type: OpenClaw Skill Name: standx-cli Version: 0.5.0 The skill is classified as suspicious due to its installation methods, which involve downloading a binary from a remote GitHub release URL via `curl -L` and then moving it to `/usr/local/bin/` using `sudo mv`. While this is a common practice for installing CLI tools and the source (GitHub) is generally trusted, it represents a significant supply chain vulnerability and requires privilege escalation. There is no evidence of intentional malicious behavior, data exfiltration, prompt injection, or obfuscation. The documentation, particularly in `SKILL.md` and `references/troubleshooting.md`, provides good security advice regarding credential handling, warning against insecure storage methods. The 'suspicious' classification is based on the inherent risk of the powerful installation scripts, which could lead to RCE if the remote source were compromised, rather than any malicious intent within the skill itself.