Mobula - Crypto Prices & Market Data

Real-time token prices, market caps, volume, and analytics across 88+ blockchains. Free tier, no credit card required.

This skill appears to do what it says (read-only crypto market data) and only needs an API key, but there are small red flags you should check before installing: - Confirm the registry metadata: the package metadata provided to the registry says no env vars are required, but the SKILL.md/README require MOBULA_API_KEY. Ask the publisher or registry maintainer to correct the metadata so automatic installation tools know the key is required. - Verify the publisher and repository: the homepage is mobula.io but the GitHub repo linked in SKILL.md/README (github.com/Flotapponnier/...) may not clearly match the official org. Confirm the repo is legitimate and maintained by the service you trust. - Treat API keys as sensitive: set MOBULA_API_KEY in your environment, avoid committing it to code or public dotfiles, and consider using a scoped/test key when trying the skill first. If you store it in ~/.zshrc, be aware other processes/users on the machine may read it. - Limit blast radius: test the skill with a throwaway or low-privilege API key and monitor usage/rate limits. If the service supports key rotation or IP-restriction, enable those protections. - Privacy & policy: review mobula.io docs/privacy and API docs to confirm the API key only grants read access to public market data and that the provider’s logging/usage policies meet your requirements. Given the inconsistency in published metadata (missing MOBULA_API_KEY requirement) and the unknowns about repository ownership, proceed cautiously and ask the maintainer/registry to clarify before trusting a production key.

Type: OpenClaw Skill Name: mobula-prices Version: 1.0.1 The mobula-prices skill is a standard integration for fetching cryptocurrency market data, prices, and metadata from the Mobula API (api.mobula.io). It operates in a read-only capacity, requires a user-provided API key (MOBULA_API_KEY), and contains no evidence of malicious code, data exfiltration, or prompt-injection attacks. The instructions in SKILL.md and README.md are consistent with the stated purpose of providing market analytics across multiple blockchains.