← 返回 Skills 市场
70
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install crypto-first-steps-coach
功能描述
A calm beginner guide that helps a first-time user understand what crypto is, what to learn first, and what not to rush into. Use when the user is new to cry...
使用说明 (SKILL.md)
crypto-first-steps-coach
A calm, safety-first onboarding guide for people new to cryptocurrency.
Workflow
- Ask about experience level, curiosity level, time horizon, and why the user is interested.
- Classify the user into a starting profile: curious observer, learning beginner, or ready-for-tiny-experiment.
- Explain 3–5 foundational concepts in the right order.
- Offer a staged path: learn → observe → secure basics → optional tiny action → reflect.
- Include a do-not-do-yet list to avoid common early mistakes.
Output Format
- User starting profile
- Top concepts to learn next
- Safe first-week or first-month path
- Do-not-do-yet list
- One reflection question
Quality Bar
- Works for a total beginner with minimal prior knowledge.
- Avoids jargon, or explains jargon immediately.
- Gives sequence and emotional calm, not just information.
- Includes safety warnings without sounding alarmist.
Edge Cases
- If the user wants fast recovery from losses or urgent money, explicitly slow them down.
- If the user asks for exact coin picks or leverage plays, redirect to education and risk awareness.
Compatibility
- Prompt-only, no real-time data required.
- Works best when the user shares their goal, budget comfort, and timeline.
安全使用建议
This skill is likely well-intentioned (a beginner crypto guide) but contains a code file that reads a hard-coded path in /Users/jianghaidong/.openclaw/skills/{skill_name}/SKILL.md, which contradicts the 'prompt-only' claim. Before installing or enabling autonomous invocation: (1) ask the author why the absolute, user-specific path is used and request removal or replacement with a relative/resource-based load; (2) inspect or remove handler.py if you only want the written SKILL.md behavior; (3) run the skill in a sandboxed environment to confirm it doesn't read unexpected files; and (4) decline to provide any credentials or sensitive files. If the author can't justify the file access, treat the code as suspicious and avoid enabling the skill.
功能分析
Type: OpenClaw Skill
Name: crypto-first-steps-coach
Version: 1.0.0
The skill bundle contains a hardcoded absolute path to a specific local user directory ('/Users/jianghaidong/') in handler.py, which is highly irregular for a portable agent skill. This creates a path traversal vulnerability where the 'skill_name' parameter could be manipulated to attempt to read arbitrary files on the host system, although the current implementation does not exfiltrate the data. While the SKILL.md content is benign and safety-oriented, the presence of specific local environment paths and lack of input validation is a significant security concern.
能力标签
能力评估
Purpose & Capability
SKILL.md describes a prompt-only, no-real-time-data guide that requires no binaries, env vars, or file access. The included handler.py, however, attempts to read a SKILL.md from a hard-coded path (/Users/jianghaidong/.openclaw/skills/{skill_name}). That file system access is unrelated to the declared purpose and looks like either a developer leftover or a potential privacy mismatch.
Instruction Scope
The runtime instructions (SKILL.md) make no mention of reading local files or user home directories. The handler's call to open a file in a specific user's home violates the stated 'no real-time data required' constraint and expands scope unexpectedly.
Install Mechanism
No install spec, no downloads, and no external packages are declared. The risk from installation is low because nothing is fetched or written to disk during install.
Credentials
The skill declares no required environment variables or credentials and the code does not reference env vars or secret names. There is no apparent request for excessive credentials.
Persistence & Privilege
always:false and normal invocation settings — the skill does not request persistent platform-wide privileges. However, the handler's hard-coded filesystem read probes a specific user path which may access local files if the runtime environment shares that path; this is a scoped but unexpected file access.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install crypto-first-steps-coach - 安装完成后，直接呼叫该 Skill 的名称或使用
/crypto-first-steps-coach触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release — calm, staged onboarding guide for cryptocurrency beginners.
- Step-by-step workflow to assess user profile and provide tailored concepts in order.
- Offers a safe path: learn, observe, secure basics, (optional) tiny action, reflect.
- Includes a clear “do-not-do-yet” list highlighting common early mistakes to avoid.
- Output is structured: user profile, concepts to learn, safe starting path, warning list, and a reflection question.
- Prioritizes plain language, emotional calm, and actionable safety advice for true beginners.
元数据
常见问题
Crypto First Steps Coach 是什么？
A calm beginner guide that helps a first-time user understand what crypto is, what to learn first, and what not to rush into. Use when the user is new to cry... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 70 次。
如何安装 Crypto First Steps Coach？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install crypto-first-steps-coach」即可一键安装，无需额外配置。
Crypto First Steps Coach 是免费的吗？
是的，Crypto First Steps Coach 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Crypto First Steps Coach 支持哪些平台？
Crypto First Steps Coach 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Crypto First Steps Coach？
由 haidong（@harrylabsj）开发并维护，当前版本 v1.0.0。
推荐 Skills