₿ CryptoWatch - 实时监控加密货币价格，价格突破自动预警

This package largely does what it claims (fetches CoinGecko data and stores local alerts), but several red flags mean you should be cautious: - Do not send money based on the README/SKILL.md 'sponsorship' claim without verifying the project. The code contains wallet addresses but there is no implemented enforcement or unlock mechanism — the donation request could be legitimate or opportunistic. Never send funds to an unverifiable recipient. - SKILL.md mentions scripts/rank.mjs that are not present and advertises a paid tier (5 queries/day free) that the code does not enforce — this inconsistency suggests sloppy packaging or possible misrepresentation. - Registry metadata says 'Source: unknown' and 'Homepage: none' while package.json points to GitHub/ClawHub. Verify the upstream repository (check the GitHub URL, npm package, and commit history) before trusting or installing. Confirm the maintainers and recent activity. - Because the README suggests installing via 'npx', if you run that command you will fetch whatever is published to npm at that name; double-check the npm package contents and verify the package author. Consider auditing the published npm package, not just these bundled files. - The CLI writes config/alerts.json to its directory — this is local persistence only, but if you run it from a sensitive directory it will create files there; run it in an isolated folder or sandbox. Recommended next steps: inspect the upstream GitHub repo and the npm package (if published), confirm the vendor identity, run the scripts in a sandbox/container and monitor outbound network calls (they should only target api.coingecko.com), and do not transfer any funds unless you can independently verify the project's legitimacy.

Type: OpenClaw Skill Name: cryptowatch Version: 1.0.2 The cryptowatch bundle is a legitimate cryptocurrency price monitoring tool that utilizes the public CoinGecko API. The scripts (watch.mjs, top.mjs, and alert.mjs) perform standard network requests to fetch market data and manage local price alerts via a JSON configuration file. No evidence of data exfiltration, malicious code execution, or harmful prompt injection was found; the bundle's behavior is entirely consistent with its stated purpose.