크립토 토큰 시장 동향 및 센티먼트 종합 분석 에이전트

What to consider before installing: - Metadata mismatch: The registry lists no required env vars, but the code expects and uses LLM API keys (GROQ_API_KEY, ANTHROPIC_API_KEY, GOOGLE_API_KEY) and a TAVILY_API_KEY. Do not provide production secrets until you confirm which keys are actually needed. - .env loading: The code explicitly loads ../.env. That will read any secrets placed there; avoid sharing a .env containing unrelated credentials. Prefer running in a disposable/sandbox environment. - Network calls: The agent calls external services (CoinGecko, Tavily, and LLM provider APIs). Confirm you trust those endpoints and the privacy of any data you send (news text, token names, and any contextual logs). - Logging: The code logs API key presence and provider names; logs may expose metadata about your keys. Consider removing or redacting such logging before running in production. - Dependencies: Installation will pull packages from npm (openai, @anthropic-ai/sdk, dotenv). Audit dependencies or install in an isolated environment. - Prompt behavior: The skill forces strict JSON system prompts to the LLM. This is normal for structured output but could be abused to coerce models; review the system prompts in analyzer.ts to ensure they do not request data exfiltration or to override host policies. Recommended actions: 1) Inspect and sanitize the .env.example and any .env you plan to use; only include the minimal keys needed. 2) Run the skill in a sandboxed environment (no access to sensitive .env or production networks) and monitor outbound traffic. 3) If you intend to use your own LLM keys, prefer creating dedicated limited-permission API keys. 4) Ask the publisher to update registry metadata to declare required env vars and to remove any logging of secret presence. Given the undisclosed secret access and metadata mismatch, treat this skill as suspicious until those issues are resolved.

Type: OpenClaw Skill Name: agent-crypto-lens Version: 1.0.1 The CryptoLens Agent bundle is a legitimate tool for analyzing cryptocurrency market trends and sentiment. It uses standard integrations for CoinGecko (market data), Tavily (web search), and various LLM providers (Anthropic, Gemini, Groq) to generate reports. The code in src/analyzer.ts and src/fetcher.ts follows the stated purpose without any signs of data exfiltration, unauthorized command execution, or malicious prompt injection.