Multichain Portfolio Tracker

Track multi-chain crypto portfolio with real-time prices, P&L, and alerts. Supports EVM (Ethereum, Base, Arbitrum, Polygon, Optimism), Solana, and manual ent...

This skill appears to implement what it claims, but before installing or running it: (1) understand that the scripts query public RPC providers and CoinGecko — those external services will receive the wallet addresses and token symbols you check (they can log requests and IPs). If you care about privacy, replace the hard-coded RPC URLs with your own RPC provider or a private node. (2) The SKILL.md mentions pnl.sh but that file is missing — expect limited P&L functionality until you add/implement it. (3) Inspect the scripts locally (they are simple bash/python) and run them in a restricted environment if you are unsure. (4) If you want to avoid third-party logging entirely, configure trusted RPC endpoints or API keys that you control. If you want me to, I can point out exactly which lines to change to swap in custom RPC URLs or remove any specific endpoint.

Type: OpenClaw Skill Name: multichain-portfolio-tracker Version: 1.0.0 The skill bundle contains multiple command and script injection vulnerabilities where user-controlled data from 'portfolio.json' is passed unsanitized into shell commands and Python execution strings. Specifically, in 'scripts/alerts.sh', 'scripts/check-wallet.sh', and 'scripts/portfolio.sh', variables like token symbols, addresses, and chain names are embedded directly into 'python3 -c' calls or heredocs, allowing for arbitrary code execution if the configuration file is populated with malicious payloads (e.g., via prompt injection against the agent). While the tool appears to be a legitimate crypto tracker using public APIs (CoinGecko) and RPCs (LlamaRPC, Solana), the lack of input sanitization poses a significant security risk.