Token Unlock Pro

专业的代币解锁预警系统 - 支持72h/48h/24h/6h/实时多维度预警，类型分类（种子轮/公募/生态/质押），解锁额度分级，用户自定义监控，解锁日历月/周/日视图，历史数据分析及走势预测。每次调用需支付0.001 USDT。

This skill is generally coherent with its stated purpose (token-unlock alerts) but has implementation issues that warrant caution: - The code and README embed a default SKILLPAY API key and SKILL_ID; treat that as a leaked/placeholder secret. Do not assume it is safe to use. Ask the author to remove any hard-coded keys and never ship secrets in source files. - Config.DEBUG defaults to true and the payment routine bypasses charging in debug mode. If you need enforcement of payments, set DEBUG=false and verify charge_user works against SkillPay with your own key. - The service makes outbound calls to skillpay.me (billing) and likely to token data providers; run it in an isolated environment if you test it and inspect network activity. - If you plan to install/run the code: replace the embedded API key with your own, set DEBUG=false, rotate any keys if they were leaked, and review the entire api/main.py for any other hard-coded endpoints or unexpected behavior (the source appears to have a truncated function in the provided snapshot that should be fixed). If you cannot confirm the developer identity or cannot safely replace/remove the embedded secrets, avoid installing this skill in production or on machines with sensitive credentials.

Type: OpenClaw Skill Name: token-unlock-pro Version: 1.0.1 The skill bundle contains a large, undocumented, and unrelated script in 'index.html' titled 'Iframe Highlight Injector'. This script monitors all user interactions (hovers, clicks) and captures detailed element metadata, including text content and values from 'INPUT' and 'TEXTAREA' tags, which it then exfiltrates to the parent window via 'postMessage'. While this appears to be a developer tool from the MiniMax AI platform, its silent inclusion in a token-monitoring skill bundle poses a significant privacy risk and could be used to capture sensitive user input. Additionally, 'api/main.py' contains a hardcoded SkillPay API key (sk_4fcc...ec4b) as a default configuration value.