此技能由Tradingbase团队开发，旨在提供全面的加密货币市场分析技能。从币安获取所有币种的实时行情数据，计算多种技术指标（MACD, KDJ, RSI, CCI, BOLL, WR, PSY, BRAR, DMI），并利用用户连接的LLM进行市场分析。支持短期（默认1小时K线）和中长期（默认1天K线）分析，...

This skill appears to implement its stated purpose (fetching Binance public data and computing indicators), but exercise caution before installing/using it: - Hard-coded Python path: main_analysis.py uses PYTHON_EXECUTABLE = "E:\\anaconda\\python.exe" and runs pip through that executable. This is brittle and odd — if that path exists on your machine it will be invoked; if not, the installation attempt will fail. Ask the author to remove or make this configurable (use sys.executable or an explicit configurable python path). - Runtime pip install: the script attempts to auto-install TA-Lib via subprocess. That modifies your Python environment and runs third-party install steps (potentially compiling native code). Prefer installing dependencies yourself in a dedicated virtualenv/container rather than letting the skill auto-install. - Network calls: the skill calls Binance public APIs (expected). There are no declared secrets, but review the truncated portion of main_analysis.py to confirm there are no other external endpoints (LLM invocation code was not visible in full). - Recommendation: only run this skill in an isolated environment (virtualenv, container, or sandbox) after inspecting/modifying main_analysis.py to remove or parameterize the hard-coded python path and to disable automatic installs. If you plan to trust it, ask the publisher for a reputable homepage/source or for the missing portion of the main script so you can verify LLM calls and final behavior. If you are not comfortable auditing the code, do not run it against production environments or systems with sensitive data.

Type: OpenClaw Skill Name: crypto-market-analysis Version: 1.0.1 The skill bundle contains high-risk behaviors in 'main_analysis.py', specifically a hardcoded local file path ('E:\anaconda\python.exe') and a function that automatically executes 'pip install' to fetch and install external dependencies (TA-Lib). While these actions are plausibly intended for environment setup, the use of subprocess to modify the host system and the reliance on a specific local environment path are significant security risks and lack the portability expected of a benign skill. No clear evidence of intentional data exfiltration or malicious prompt injection was found.