← Back to Skills Marketplace
Exchange Rate
by
JaceyMarvin99
· GitHub ↗
· v0.1.0
461
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install exchange-rate-2
Description
Use when users need to query daily currency exchange rates between two currencies.
README (SKILL.md)
Exchange Rate Skill
This skill helps AI agents fetch daily currency exchange rates from the 60s API.
When to Use This Skill
Use this skill when users:
- Ask for current exchange rates between two currencies.
- Want to know the value of one currency in another.
- Need the latest currency conversion rate.
How to Use
Execute the associated scripts/exchange_rate.sh script to fetch the exchange rate.
./scripts/exchange_rate.sh [options]
Options
--currency, -c \x3Ccurrency>: Optional. The base currency ISO 4217 code. Defaults toCNY.--target, -t \x3Ctarget>: Optional. The target currency ISO 4217 code. Defaults toUSD. If set toAAA, it returns all available exchange rates for the base currency.
Return Values
The script outputs the exchange rate value of the target currency relative to 1 unit of the base currency.
If the target is AAA, it outputs the full JSON response containing all rates.
If the target currency is not found, an error message is returned.
Usage Examples
# Get the exchange rate from CNY to USD (default)
./scripts/exchange_rate.sh
# Get the exchange rate from EUR to JPY
./scripts/exchange_rate.sh --currency EUR --target JPY
# Get all exchange rates for GBP
./scripts/exchange_rate.sh -c GBP -t AAA
Usage Guidance
This skill appears to implement an exchange-rate lookup but has two practical red flags: (1) the included shell script requires curl and jq even though the manifest lists no required binaries — verify those tools will be available or update the skill declaration; (2) the script calls an undocumented third-party API (https://60s.viki.moe). Before installing or running it, review and validate that API endpoint (owner, privacy policy, reliability). If you plan to run the script, do so in a sandboxed environment, inspect the script thoroughly, and consider replacing the remote API with a known/trusted provider (or adding explicit configuration options).
Capability Analysis
Type: OpenClaw Skill
Name: exchange-rate-2
Version: 0.1.0
The `scripts/exchange_rate.sh` file contains a critical shell injection vulnerability. The `CURRENCY=$(echo "$CURRENCY" | tr '[:lower:]' '[:upper:]')` and `TARGET=$(echo "$TARGET" | tr '[:lower:]' '[:upper:]')` lines are susceptible to command injection. If user-provided input for `--currency` or `--target` contains shell command substitutions (e.g., `$(command)` or backticks), these commands will be executed when `echo` processes the string, leading to Remote Code Execution (RCE). The `SKILL.md` file instructs the AI agent to execute this script with user-controlled parameters, providing a direct vector for prompt injection to exploit this vulnerability.
Capability Assessment
Purpose & Capability
The skill's name/description match its behavior (fetching exchange rates). However the manifest declares no required binaries or credentials while the included script clearly depends on curl and jq and performs network requests to a specific API host. Omitting those binary requirements is an incoherence.
Instruction Scope
SKILL.md instructs the agent to run scripts/exchange_rate.sh which issues an outbound HTTPS request to https://60s.viki.moe/v2/exchange-rate. The instructions do not warn about the network call or disclose the full API host, nor do they document expected JSON schema. The script does not read local files or secrets.
Install Mechanism
No install spec is provided (instruction-only plus a script). Nothing is written to disk by an installer; risk is limited to running the included script.
Credentials
The skill declares no environment variables or credentials and the script does not request secrets. This is proportional. However the script makes outbound calls to an external API (unknown origin) which may expose query parameters; no credential access is requested.
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent privileges. It does not modify other skills or system-wide settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install exchange-rate-2 - After installation, invoke the skill by name or use
/exchange-rate-2 - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
- Initial release of the exchange-rate skill.
- Allows querying daily currency exchange rates between two currencies using the 60s API.
- Provides a shell script (`exchange_rate.sh`) for fetching rates with configurable base and target currencies.
- Supports retrieving all available exchange rates for a given base currency.
- Includes clear usage instructions and examples.
Metadata
Frequently Asked Questions
What is Exchange Rate?
Use when users need to query daily currency exchange rates between two currencies. It is an AI Agent Skill for Claude Code / OpenClaw, with 461 downloads so far.
How do I install Exchange Rate?
Run "/install exchange-rate-2" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Exchange Rate free?
Yes, Exchange Rate is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Exchange Rate support?
Exchange Rate is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Exchange Rate?
It is built and maintained by JaceyMarvin99 (@jaceymarvin99); the current version is v0.1.0.
More Skills