call coinank openapi to get data

This skill appears to do what it says: it will read the included OpenAPI JSON files and README and then call https://open-api.coinank.com using the COINANK_API_KEY you supply (sent in the HTTP header). Before installing, confirm you trust coinank.com and are comfortable exposing the API key to that external service. Use a key with minimal privileges if possible and rotate or revoke the key if you stop using the skill. Note that the skill may log request errors (check where agent logs are stored) — avoid putting high-privilege or unrelated secrets into the same environment.

Type: OpenClaw Skill Name: coinank-openapi Version: 1.0.2 The `SKILL.md` instructs the AI agent to construct `curl` commands for API interaction. While the network requests are restricted to a specific domain (`https://open-api.coinank.com`), the instructions do not explicitly detail input sanitization for user-provided parameters (e.g., `symbol`, `exchange`, `endTime`, `size`) when building these `curl` commands. This creates a potential shell injection vulnerability if the AI agent's execution environment does not adequately sanitize user input before executing shell commands, allowing for unauthorized command execution. However, there is no clear evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints or persistence mechanisms within the skill bundle.