Token Analyzer

基于官方 GMGN API 的代币分析工具。通过合约地址查询代币在 SOL/BSC/Base 链上的准确市场数据、安全检测、KOL 分析、开发者分析和 AI 智能分析（叙事/筹码/老鼠仓/机器人）。支持自动识别链。

This skill appears to do what it claims (query GMGN and analyze tokens) but I found several red flags you should consider before installing or running it: - Embedded secret: scripts/token_query.py contains a hardcoded AVE_API_KEY. Embedded API keys are a security and provenance concern — ask the author to remove it and provide a documented mechanism (environment variable or user-provided key) instead. - Undeclared dependencies: the SKILL.md and code expect a Chrome DevTools endpoint (CDP on localhost:9222), a specific Chrome extension (OpenClaw Browser Relay), and the external 'bird' CLI for Twitter scraping. The registry metadata does not list these binaries. Ensure you only run this on a trusted machine, and install/inspect the extension and bird CLI from official sources. - Local CDP risk: the skill instructs you to run Chrome with remote debugging and attach OpenClaw to it. Exposing a CDP port (even bound to localhost) can be risky if other local processes are untrusted. Only start Chrome with CDP bound to 127.0.0.1, and prefer running as a non‑privileged user and in an isolated environment. - Prompt injection / hidden chars: the SKILL.md contained unicode control characters. Ask the author for a cleaned SKILL.md or manually inspect/copy it into a trusted editor to ensure there are no hidden or malicious instructions. - Metadata mismatch and provenance: _meta.json and package.json list older versions than SKILL.md, and there's no homepage or clear source. Prefer skills with a known homepage, repo, and author, or ask for origin and changelog verification. What you can do now: - Request the author to remove embedded keys and declare required binaries/env vars in metadata. - Run the code in an isolated environment (VM/container) and review the Chrome extension and 'bird' CLI before use. - If you don't trust the included Ave key, delete it and supply your own (or disable Ave integration). - If you want me to, I can: point to the exact lines with the embedded key, extract a cleaned SKILL.md with control characters removed, or produce a checklist of required runtime steps to run this safely in a container.

Type: OpenClaw Skill Name: token-analyzer Version: 2.5.0 The bundle is a crypto token analyzer that uses the Chrome DevTools Protocol (CDP) to bypass anti-bot protections on gmgn.ai. It is classified as suspicious due to several high-risk requirements and practices: SKILL.md instructs the user to run Chrome with security features disabled (--no-sandbox, remote debugging) and install a specific external browser extension; scripts/token_query.py contains a hardcoded API key for Ave.ai; and scripts/token_query_v2.py executes external shell commands via subprocess (specifically a 'bird' CLI tool). While these behaviors are technically consistent with the tool's scraping objectives, they significantly expand the attack surface and weaken the host's security posture.