← 返回 Skills 市场

Bitpanda

Name: Bitpanda
Author: florianbeer

作者 Florian Beer · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

581

总下载

当前安装

版本数

在 OpenClaw 中安装

/install bitpanda

功能描述

Check your Bitpanda crypto portfolio, wallet balances, and trade history via CLI using your API key with read-only access.

使用说明 (SKILL.md)

Bitpanda Portfolio Skill

Check Bitpanda crypto portfolio, wallet balances, and trade history via CLI.

Auth

API key is read from (in order):

BITPANDA_API_KEY environment variable
~/.openclaw/credentials/bitpanda/config.json → {"api_key": "..."}

Generate at: https://web.bitpanda.com/my-account/apikey Recommended scopes: Balance, Trade, Transaction

Commands

bitpanda portfolio                    # Non-zero wallets grouped by crypto/fiat/index
bitpanda wallets                      # All non-zero wallets with balances
bitpanda transactions --limit 20      # Recent trades
bitpanda transactions --flow buy      # Buy trades only
bitpanda transactions --flow sell     # Sell trades only
bitpanda asset BTC                    # Current price + your balance

Notes

Read-only — no trading or transfers
Assets in Bitpanda Earn/Staking are not exposed by the API and won't show in balances
The asset command uses the public ticker (no auth needed) for prices
Pagination is automatic
Requires: curl, jq, bc

安全使用建议

This skill largely does what it says: it reads a Bitpanda API key (env var or ~/.openclaw/credentials/bitpanda/config.json) and makes GET calls to Bitpanda's API to show balances and trades. Before installing: (1) Confirm the API key you create is strictly read-only — do NOT grant trading/transfer permissions; the SKILL.md's suggested 'Trade' scope may be broader than necessary. (2) Note the registry metadata in the portal omitted the required env/credentials but the package files do require BITPANDA_API_KEY; treat the package files as authoritative. (3) Inspect the full script yourself (the distributed scripts/bitpanda.sh) to ensure it matches the truncated preview and there are no hidden network endpoints. (4) Keep the credentials file private (chmod 600) and consider using an API key with the minimal scopes and limited lifetime. If you want higher assurance, run the script in a sandboxed environment or review/execute it manually rather than granting automated agent invocation.

功能分析

Type: OpenClaw Skill Name: bitpanda Version: 1.0.0 The OpenClaw skill 'bitpanda' is classified as benign. All files (SKILL.md, scripts/bitpanda.sh, skill.json, README.md) consistently describe and implement a read-only interface to the Bitpanda API for checking portfolio, wallet balances, and trade history. The `scripts/bitpanda.sh` script correctly loads the API key from environment variables or a local credentials file and uses it to make `GET` requests to the legitimate `https://api.bitpanda.com/v1` endpoint. There is no evidence of data exfiltration to unauthorized endpoints, malicious code execution, persistence mechanisms, or prompt injection attempts against the AI agent. The script's actions are fully aligned with its stated purpose and security claims.

能力评估

ℹ Purpose & Capability

The name/description (read-only Bitpanda portfolio) matches the actual code and SKILL.md: the script calls Bitpanda GET endpoints and reads an API key. However registry metadata at the top of the report claims no required env vars/credentials while skill.json and SKILL.md do declare/expect BITPANDA_API_KEY and a credentials file (~/.openclaw/credentials/bitpanda/config.json). This metadata discrepancy is an incoherence to be aware of.

✓ Instruction Scope

Runtime instructions and the included bash script restrict themselves to reading the API key (env var or a single credentials file), calling Bitpanda API endpoints under https://api.bitpanda.com/v1, and printing formatted results. The script requires curl/jq/bc as documented. I saw no commands that read unrelated system files, call unexpected external endpoints, or transmit data to third parties.

✓ Install Mechanism

There is no install spec — the skill is instruction + a bundled bash script. No downloads, package installs, or archive extraction occur in the provided files, which reduces install-time risk.

ℹ Credentials

The only credential used is an API key (BITPANDA_API_KEY) or a single local credentials file, which is appropriate for the stated purpose. However SKILL.md recommends scopes: Balance, Trade, Transaction — the 'Trade' scope may allow non-read operations depending on Bitpanda's scope model. The script itself only issues GET requests, but you should avoid granting write/transfer scopes if you want purely read-only access.

✓ Persistence & Privilege

The skill does not request always:true, does not modify other skills or system-wide configs, and only reads a credential file in its own credentials path. It does not persist new credentials or elevate privileges.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install bitpanda
安装完成后，直接呼叫该 Skill 的名称或使用 /bitpanda 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release: portfolio, wallets, trades, asset lookup

元数据

Slug bitpanda

版本 1.0.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题

Bitpanda 是什么？

Check your Bitpanda crypto portfolio, wallet balances, and trade history via CLI using your API key with read-only access. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 581 次。

如何安装 Bitpanda？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install bitpanda」即可一键安装，无需额外配置。

Bitpanda 是免费的吗？

是的，Bitpanda 完全免费（开源免费），可自由下载、安装和使用。

Bitpanda 支持哪些平台？

Bitpanda 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Bitpanda？

由 Florian Beer（@florianbeer）开发并维护，当前版本 v1.0.0。