← 返回 Skills 市场

Crypto Portfolio Tracker API

Name: Crypto Portfolio Tracker API
Author: strykragent

作者 StrykrAgent · GitHub ↗ · v1.0.0

cross-platform ✓ 安全检测通过

722

总下载

当前安装

版本数

在 OpenClaw 中安装

/install crypto-portfolio-tracker-api

功能描述

Track crypto portfolios with real-time prices, profit/loss calculations, and allocation analysis for Bitcoin, Ethereum, Solana, and 10,000+ tokens.

使用说明 (SKILL.md)

Crypto Portfolio Tracker API

Track cryptocurrency portfolios with real-time prices and P&L calculations.

Installation

npm install crypto-portfolio-tracker-api

Usage

const { PortfolioTracker } = require('crypto-portfolio-tracker-api');

const tracker = new PortfolioTracker();

// Get current price
const btc = await tracker.getPrice('BTC');

// Get multiple prices
const prices = await tracker.getPrices(['BTC', 'ETH', 'SOL']);

// Track portfolio with P&L
const portfolio = await tracker.trackPortfolio([
  { symbol: 'BTC', amount: 0.5, costBasis: 30000 },
  { symbol: 'ETH', amount: 10, costBasis: 2000 }
]);

console.log(`Total: $${portfolio.totalValue}`);
console.log(`P&L: $${portfolio.totalPnL}`);

CLI

# Get price
npx crypto-portfolio-tracker-api price BTC

# Track portfolio from file
npx crypto-portfolio-tracker-api track portfolio.json

API Methods

getPrice(symbol) - Get single token price
getPrices(symbols) - Get multiple prices
trackPortfolio(holdings) - Calculate portfolio value and P&L

Data Source

安全使用建议

This package appears to be a normal crypto portfolio tracker that queries prismapi.ai for prices. Before installing: 1) Verify the npm package and publisher (package name in SKILL.md/package.json vs. skill.json mismatch) — install only from the official npm/org you expect. 2) Inspect the package on the npm registry or its GitHub repo to confirm the source and recent activity. 3) If you provide a PRISM_API_KEY, ensure it is a scoped API key (no private wallet keys) and understand it will be sent to https://api.prismapi.ai. 4) Prefer installing in an isolated environment and review the package code (src/index.js) for any unexpected network endpoints. If you cannot confirm the publisher or repository, treat the metadata inconsistencies as a red flag and avoid installing until provenance is confirmed.

功能分析

Type: OpenClaw Skill Name: crypto-portfolio-tracker-api Version: 1.0.0 The OpenClaw skill bundle provides a cryptocurrency portfolio tracker that interacts with the `prismapi.ai` service. The code accesses an optional `PRISM_API_KEY` from environment variables, which is a standard practice for API authentication. All network requests are directed to the declared `https://api.prismapi.ai` endpoint. Input parsing for the CLI (`cli.js`) appears safe, and there are no signs of shell injection, data exfiltration beyond the stated purpose, malicious execution, persistence mechanisms, or prompt injection attempts against the OpenClaw agent. Minor inconsistencies in documentation regarding CLI commands and package metadata do not indicate malicious intent or significant vulnerabilities.

能力评估

ℹ Purpose & Capability

The code implements the described portfolio-tracking functionality (price lookups, valuation, P&L). However, repository/package/author metadata is inconsistent across files: package.json lists name "crypto-portfolio-tracker-api" and author "OpenFinance <[email protected]>", skill.json references "strykr-portfolio-tracker" and npm "@strykr/portfolio-tracker", README/CLI text refer to Strykr/Prism. These naming and metadata mismatches are not themselves malicious but are incoherent and warrant verification of the package origin.

✓ Instruction Scope

SKILL.md contains only installation and usage instructions for the library and CLI (npm install, API calls). It does not instruct reading unrelated system files, secrets, or exfiltrating data. CLI help notes an optional PRISM_API_KEY for higher rate limits, which is consistent with the code.

✓ Install Mechanism

No install spec in the registry (instruction-only), and SKILL.md instructs installing the npm package. The provided code has no external installers or downloads and package.json lists no external dependencies—no high-risk install behavior observed.

ℹ Credentials

The code optionally reads PRISM_API_KEY from process.env.PRISM_API_KEY for higher rate limits but the registry metadata declared no required env vars. This is reasonable (optional key) but you should be aware the package will use an API key if provided. No other credentials or sensitive env vars are requested.

✓ Persistence & Privilege

The skill does not request persistent/privileged presence (always: false). It does not modify other skills or system configuration and has no install-time scripts in the manifest that would grant elevated privileges.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install crypto-portfolio-tracker-api
安装完成后，直接呼叫该 Skill 的名称或使用 /crypto-portfolio-tracker-api 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release

元数据

Slug crypto-portfolio-tracker-api

版本 1.0.0

许可证 —

累计安装 1

当前安装数 0

历史版本数 1

常见问题