加密货币投研分析框架，用于每日行情展望报告和市场实时监控。当需要：(1) 生成每日行情报告，(2) 分析BTC/ETH走势，(3) 监控市场资讯和币价异动，(4) 制定交易预案时使用此skill。

This skill largely does what it claims (calls Binance and formats crypto research), but it includes an undeclared hard-coded API key and references undeclared external tools (jin10, QVeris) and a Telegram bot. Before installing or using it: (1) Do not assume the embedded ARKM key is safe—treat it as a leaked/third-party credential and remove it or replace with your own key provided via a secure env var; (2) Ask the publisher for source/homepage and explanation for the embedded key and for details on the referenced tools; (3) If you need monitoring/alerts, confirm exactly what endpoints and external services will be contacted and whether any user data will be transmitted; (4) Run the scripts in a sandboxed environment first and inspect network calls (they currently only curl Binance endpoints, which is expected); (5) Prefer replacing hard-coded secrets with declared required env vars and documented configuration; (6) If you cannot verify the author or purpose of the embedded key and external references, avoid giving the skill autonomous monitoring privileges or installing it in production systems.

Type: OpenClaw Skill Name: crypto-research Version: 1.0.0 The skill is classified as suspicious due to two main security vulnerabilities. Firstly, the `SKILL.md` file explicitly exposes an API key (`e77c4a5d-f752-4a49-a49e-503970893e37`) for the ARKM API, which is an information disclosure risk. Secondly, the `scripts/get_7d_price.sh` script is vulnerable to shell injection as it directly interpolates the `$SYMBOL` variable into a `curl` command without apparent sanitization, posing a potential remote code execution risk if the input is user-controlled. While there is no evidence of intentional malicious behavior, these are significant security flaws.