加密货币套利监控 | Cryptocurrency Arbitrage Monitor. 支持币安、OKX、Gate.io、火币 | Supports Binance, OKX, Gate.io, Huobi. 实时价格监控、利润计算、Telegram通知 | Real-time price monitoring...

This skill appears to implement the advertised arbitrage monitor, but there are a few practical and safety issues to check before installing or running it: - Missing metadata: the registry lists no runtime dependencies or env vars, but the script requires Python (3) and the aiohttp library and optionally reads TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID. Install those dependencies and/or update the metadata. - Telegram tokens: if you set TELEGRAM_BOT_TOKEN/TELEGRAM_CHAT_ID, the script can send messages to that chat. Only provide tokens for bots/chats you control and trust. Treat the token like a secret. - Network activity: the script makes outbound HTTP requests to public exchange APIs and to api.telegram.org. Review the code yourself (it's included) and run it in an isolated environment if you are concerned. - Operational risk: this is an informational monitor only (it does not execute trades) — it does not require exchange API keys, but real arbitrage would require exchange accounts and funds; do not provide exchange API keys to this skill unless you review and trust how keys would be used. If you plan to use it: run it locally in a sandbox or VM, install Python + aiohttp, inspect/modify the script as needed, and only supply Telegram credentials you control. If you want stronger assurance, request clarification from the publisher or ask them to update the package metadata to declare dependencies and optional env vars.

Type: OpenClaw Skill Name: crypto-arb-cn Version: 1.0.1 The skill bundle provides a cryptocurrency arbitrage monitor that fetches prices from various exchanges and can send alerts to Telegram. The `scripts/arbitrage_monitor.py` script uses `aiohttp` for network requests to legitimate exchange APIs and the Telegram API. It retrieves `TELEGRAM_BOT_TOKEN` and `TELEGRAM_CHAT_ID` from environment variables, which is a standard practice for sensitive credentials. All observed behaviors, including external network calls and reading environment variables, are directly aligned with the skill's stated purpose of monitoring arbitrage and providing Telegram notifications, without any evidence of intentional malicious activity such as unauthorized data exfiltration, command injection, persistence mechanisms, or harmful prompt injection against the agent.