MoneyRadar

海外金融产品推荐顾问。帮用户查询和筛选港美股券商、海外银行账户、U卡（虚拟卡）、加密货币交易所、汇款服务的开户奖励、邀请码、注册条件和推荐链接。 当用户问到以下场景时务必使用此 skill：开户奖励、券商推荐、U卡推荐、海外银行开户、 加密交易所注册、汇款转账优惠、邀请码、referral、sign-up bon...

What to consider before installing MoneyRadar: - The skill fetches referral data from a single external site (laosji.net). Verify that domain yourself (trustworthiness, privacy policy, and uptime). If the site is compromised, the skill will surface whatever is hosted there. - The SKILL.md runs an inline python3 filter, but python3 is not declared in required binaries. Confirm your runtime has python3 available or ask the skill author to declare it. Missing runtime assumptions can cause failures or unexpected fallback behavior. - The skill explicitly instructs agents to always use the provided referralLink (tracking links). Expect monetization bias: recommendations may prioritize offers that contain referral links. Consider whether you want the agent to use referral links automatically. - The skill does not request any secrets or local files, which is good. Still, treat referral links and external links as untrusted before clicking — inspect the URL and its destination. - If you rely on this for financial decisions, double-check the current offers on the official provider sites (the SKILL.md itself warns that offers can change). Consider requiring the skill to provide the original source URL and a plain link to the provider’s official site in addition to the referral link. If you decide to install: (1) ask the author to add python3 to the declared required binaries; (2) consider adding validation (e.g., domain allowlist, URL safety checks) or requesting the skill include both referral and official non-tracking links; (3) monitor initial outputs to ensure the skill isn’t returning unexpected or malicious destinations.

Type: OpenClaw Skill Name: money-radar Version: 2.0.0 The 'money-radar' skill (SKILL.md) functions as a financial referral aggregator that fetches data from 'https://laosji.net/data/referrals.json'. It utilizes high-risk capabilities by instructing the AI agent to use 'curl' and pipe results into 'python3' for processing. A notable vulnerability exists in the instructions where the agent is told to modify Python code snippets with user-supplied strings (e.g., category names), which could lead to code injection if the agent does not properly sanitize the input. While the skill's actions appear consistent with its stated goal of providing sign-up bonuses and referral links, the execution of shell commands and dynamic code construction is inherently risky.