← Back to Skills Marketplace
Crypto Alert
by
JimmyClanker
· GitHub ↗
· v1.0.0
· MIT-0
109
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install jimmy-crypto-alert
Description
Monitor cryptocurrency prices and send alerts when thresholds are crossed. No API key required — uses Binance public API. Supports BTC, ETH, SOL, and 10+ tok...
README (SKILL.md)
Crypto Alert Monitor
Monitor cryptocurrency prices and send alerts when thresholds are crossed. No API key required — uses Binance public API.
Usage
# Check a single token
bash scripts/check-price.sh btc
# Check multiple tokens
bash scripts/check-price.sh btc eth sol
# Set an alert
bash scripts/set-alert.sh btc 100000 "BTC above 100K"
# Check alerts
bash scripts/check-alerts.sh
Configuration
Edit scripts/config.sh to set your Telegram bot token and chat ID for alerts.
How It Works
- Uses CoinGecko public API (rate limit: 10-30 calls/minute)
- Stores state in
~/.crypto-alert-state.json - Alerts trigger via Telegram bot (optional)
- Threshold format:
above:Xorbelow:X
Usage Guidance
This package appears to be a simple, local crypto-price checker that stores alerts in ~/.crypto-alert-state.json and queries public Binance/CoinGecko APIs. Before installing or running it:
- Review the scripts yourself (they are short and included). They use curl and python3 and will create/modify ~/.crypto-alert-state.json.
- Note SKILL.md mentions Telegram alerts and a scripts/config.sh file: that file is missing and none of the scripts send Telegram messages. If you expect push alerts, do not assume they exist — either implement/verify Telegram sending yourself or contact the author.
- Run the scripts in a restricted environment (non-root user or container) if you are unsure. Because they make network calls, be aware they will contact public Binance and CoinGecko endpoints.
- If you plan to add Telegram support, check where/when tokens would be read and ensure you store tokens securely rather than embedding them in world-readable files.
- If you need stronger assurance, ask the publisher for the missing config implementation or for an updated release that implements alert delivery as described.
Capability Analysis
Type: OpenClaw Skill
Name: jimmy-crypto-alert
Version: 1.0.0
The skill bundle contains a code injection vulnerability in `scripts/set-alert.sh`, where shell variables are directly interpolated into a Python string literal within a heredoc. This allows for arbitrary Python code execution if a user provides a specially crafted message or token name. While the scripts functionally align with the stated purpose of monitoring cryptocurrency prices via Binance and CoinGecko APIs, the insecure implementation of state management and lack of input sanitization pose a significant security risk.
Capability Assessment
Purpose & Capability
The name/description (monitor prices, send alerts) align with the included scripts: check-price.sh queries Binance and set-alert.sh/check-alerts.sh manage a JSON state file. However SKILL.md instructs the user to edit scripts/config.sh to set a Telegram bot token/chat ID for alerts, but no scripts/config.sh is included and none of the shipped scripts implement sending alerts via Telegram. This is a mismatch between the claimed alert-delivery feature and the actual code.
Instruction Scope
Runtime instructions are limited and explicit (run the provided scripts). The scripts only access the user's home directory (~/.crypto-alert-state.json), call public APIs (CoinGecko and Binance) over the network, and invoke python3/curl. They do not read other system files or environment variables beyond HOME, nor do they exfiltrate data to unknown endpoints. The SKILL.md's Telegram instructions refer to a config file that does not exist and the code does not source a config, which is misleading.
Install Mechanism
No install spec and no external downloads — the skill is instruction-only with included shell/Python scripts. Nothing is written to disk by an installer; the only runtime write is the state file in the user's home directory, which is expected for this functionality.
Credentials
The skill declares no required credentials and the code does not require secrets. SKILL.md suggests configuring a Telegram bot token/chat ID, but the repository lacks that config and the scripts don't use it. Requesting no credentials is proportionate to the visible code, but the doc could mislead users into providing a token they don't need or the author may have forgotten to include alert-sending functionality.
Persistence & Privilege
The skill does not request persistent platform privileges (always:false). It writes a single JSON state file under the user's home directory (~/.crypto-alert-state.json) which is consistent with its purpose. It does not modify other skills or system-wide settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install jimmy-crypto-alert - After installation, invoke the skill by name or use
/jimmy-crypto-alert - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of crypto-alert.
- Monitor cryptocurrency prices for BTC, ETH, SOL, and 10+ tokens.
- Send alerts when price thresholds are crossed, with no API key required.
- Supports single or multi-token checks via simple shell scripts.
- Optional Telegram integration for real-time alert notifications.
- Uses Binance public API for pricing and supports basic local configuration.
Metadata
Frequently Asked Questions
What is Crypto Alert?
Monitor cryptocurrency prices and send alerts when thresholds are crossed. No API key required — uses Binance public API. Supports BTC, ETH, SOL, and 10+ tok... It is an AI Agent Skill for Claude Code / OpenClaw, with 109 downloads so far.
How do I install Crypto Alert?
Run "/install jimmy-crypto-alert" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Crypto Alert free?
Yes, Crypto Alert is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Crypto Alert support?
Crypto Alert is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Crypto Alert?
It is built and maintained by JimmyClanker (@jimmyclanker); the current version is v1.0.0.
More Skills