OKX加密货币技术分析工具 — 使用欧易API获取实时行情数据，计算技术指标（MA、MACD、RSI、布林带等），生成交易信号。当用户需要加密货币行情分析、技术指标计算、或交易信号时触发此skill。

This skill mostly does what it says (fetch OKX candles and compute indicators), but several inconsistencies deserve caution: - Metadata vs reality: The registry lists no required env vars, but both SKILL.md and the code require OKX_API_KEY and OKX_API_SECRET. Do not assume a skill needs no secrets when its files ask for them. - Secrets handling: The code asks for your API_SECRET. Provide only read-only API keys with the minimum scope and, if possible, restrict them by IP/whitelist and rotate them after use. Never reuse high-privilege keys. - Undeclared external endpoint: okx_analyst.py defines NS3_BASE (https://api.ns3.ai/feed) which is not mentioned in the README — review the full script to see if it sends any of your data to that service. If you cannot audit the code end-to-end, avoid providing credentials. - Local persistence: quick_check.py writes state to ~/.openclaw/skills/okx-trading-analyst/data/last_state.json. Expect local files to be created; inspect contents if you are concerned about what is stored. - Origin and trust: Source/homepage are unknown. Prefer skills from known authors or with a public repo you can audit. If you decide to install: - Inspect okx_analyst.py and quick_check.py fully (search for network calls, POST requests, or unexpected data uploads). - Run in a sandboxed environment or VM first. - Use read-only OKX keys with minimal privileges and rotate them after testing. - If you don't want any secrets on disk, avoid creating the .env and use mocked/local data instead. If you want, I can scan the remainder of okx_analyst.py (the truncated portion) for uses of NS3_BASE or any other outbound POST/PUT/requests that might transmit data beyond OKX.

Type: OpenClaw Skill Name: erong-okx-trading-analyst Version: 1.0.0 The script `scripts/okx_analyst.py` contains hardcoded absolute paths to a specific user's home directory (`/Users/yirongcao/`) and attempts to execute external scripts via `subprocess.run`. Additionally, `scripts/analyze.js` uses `execSync` to run commands constructed from arguments without sufficient sanitization, creating a potential shell injection vulnerability. While the core logic aligns with the stated trading analysis purpose, these risky execution patterns and the handling of sensitive API keys are significant security flaws.