Real-time crypto prices and 100+ technical indicators (RSI, MACD, etc.) using Binance API. 支持实时行情监控、指标计算及全网资产扫描。Pure technical reference, zero external ads.

This skill appears to do what it says: it fetches public market data from Binance and CoinGecko and computes indicators locally using Bash+Python. Before installing, note that (1) the script will make outbound network requests to public APIs (so your agent needs internet access), (2) it executes a bundled shell script and embedded Python — review scripts/script.sh if you want to audit exact behavior, and (3) public APIs may be rate-limited. No secrets or elevated privileges are requested, so the footprint is proportionate to the described purpose.

Type: OpenClaw Skill Name: bytesagain-crypto Version: 1.0.0 The skill bundle provides cryptocurrency market data and technical indicators but contains a code injection vulnerability in scripts/script.sh. The cmd_pairs function unsafely interpolates the user-provided 'filter' argument directly into a Python script executed via 'python3 -c', which could allow for arbitrary code execution if a crafted string (e.g., containing single quotes and Python commands) is passed. While the overall functionality aligns with the stated purpose and no evidence of intentional malice or data exfiltration was found, this lack of input sanitization poses a significant security risk.