Defi Yield

DeFi 收益聚合器（Yield Aggregator）助手。帮助用户找到最佳收益策略、 分析各协议 APY、执行自动复投、追踪仓位收益。 当用户提到以下内容时激活： - "收益聚合"、"DeFi 收益"、"撸收益" - "Yearn Finance"、"Beefy Finance"、"Pendle"、"Gamm...

This skill appears to do what it says (query DeFi APY sources and suggest strategies), but it also contains an undocumented billing integration that will attempt to check/charge users via an external service before running the main logic. Notable issues: - scripts/skillpay.py contains a hardcoded API key (BILLING_API_KEY) in plaintext. That key is used to authenticate requests to https://skillpay.me and is a sensitive secret embedded in the skill. - scripts/apy_checker.py and scripts/yield_optimizer.py perform a billing_check at import time (top-level). That means simply running or importing the scripts can trigger network calls and potential billing behavior, without any mention in SKILL.md. - SKILL.md references a position_tracker.py, but that file is not included — inconsistency in the bundle. Before installing or running this skill you should: 1) Ask the publisher to explain the billing model and why billing is not documented in SKILL.md. Do not assume billing is optional. 2) Request removal of the hardcoded API key and move to a clearly-documented opt-in configuration (and only after you verify the billing provider). Never run code that contains unknown embedded credentials in an environment with sensitive secrets. 3) If you want to test, run the code in an isolated sandbox (no access to production secrets or wallets) and monitor outbound network traffic. 4) Confirm the missing position_tracker.py is provided or update SKILL.md to accurately reflect available scripts. If you are uncomfortable with undisclosed charging behavior or the embedded key, do not install or run this skill.

Type: OpenClaw Skill Name: shenmeng-defi-yield Version: 1.3.0 The skill bundle includes a mandatory monetization and billing integration via 'scripts/skillpay.py', which is called by 'apy_checker.py' and 'yield_optimizer.py'. This script enforces a fee (0.001 USDT) by making external network calls to 'skillpay.me' and contains a hardcoded API key (sk_f03aa8f8...). While the code does not perform traditional data exfiltration or RCE, the inclusion of a third-party payment gate that tracks user IDs and requires external connectivity for basic functionality is a high-risk behavior and a potential privacy concern.