Whale Alert Monitor 大户监控

虚拟币大户账户预警监测助手 - 实时监控鲸鱼钱包动向、大额转账、交易所资金流向。 当用户需要以下功能时触发此skill： (1) 监控特定大户/鲸鱼钱包的交易活动 (2) 追踪大额资金流入/流出交易所 (3) 设置自定义阈值的大额转账预警 (4) 分析鲸鱼持仓变化和积累/派发模式 (5) 接收Telegram/D...

This skill largely implements the advertised whale-monitoring functionality, but there are important inconsistencies you should resolve before installing or running it: - Do not trust embedded secrets: payment.py includes a hardcoded BILLING_API_KEY. Treat that as a red flag — ask the author why it's there and request its removal. Do not run these scripts on an environment that contains sensitive credentials or production access until this is resolved. - Clarify billing enforcement: _meta.json claims SkillPay billing is required, SKILL.md advertises per-call charges, but the main monitoring scripts do not clearly call the payment check. Ask whether the runtime will actually perform billing and which processes contact skillpay.me. If billing is required, prefer an implementation that uses a user-provided API key (via env var) and server-side billing verification instead of hardcoding keys. - Confirm network endpoints: alert manager sends to Telegram/Discord/webhook URLs supplied by env/config — those are expected. Confirm you are comfortable providing those notification credentials. Consider using a dedicated, limited bot/webhook rather than broad-purpose tokens. - Run in a sandbox first: execute the code in an isolated/test environment to observe runtime network behavior (which endpoints are contacted and when). Monitor outbound connections, and inspect logs for calls to skillpay.me or unexpected hosts. - If you plan to use this skill in production: request code changes from the maintainer to remove hardcoded keys, surface required env vars clearly, and add an audit log of billing calls. If the author cannot or will not address these issues, avoid installing the skill or only run it after manual code review and key removal. I assessed these issues with high confidence because the hardcoded key and metadata mismatch are directly visible in the repository.

Type: OpenClaw Skill Name: shenmeng-whale-alert-2025 Version: 1.0.0 The skill implements a mandatory pay-per-use monetization system called 'SkillPay' in `payment.py`, which contains a hardcoded API secret (`sk_f03...`) and communicates with an external billing endpoint (`skillpay.me`). While the `SKILL.md` and documentation describe a sophisticated real-time cryptocurrency monitoring tool, the actual implementation in scripts like `whale_tracker.py`, `transfer_monitor.py`, and `exchange_flow.py` relies almost entirely on simulated data generated by the `random` module rather than real blockchain API integrations. This discrepancy between the advertised functionality and the actual code, combined with the hardcoded credentials and the requirement for users to pay for simulated results, is highly suspicious.