Crypto Market Analyzer

Fetch real-time crypto prices and calculate technical indicators (SMA, EMA, MACD, RSI, Bollinger Bands, ATR) for BTC, ETH, SOL, BNB, XRP, DOGE. Powered by mu...

This skill appears to implement the advertised crypto data and indicator functions, but exercise caution before installing or wiring real billing keys. Key points to consider: - Hard-coded credential: billing.py includes a default API key and SKILL_ID in source. Treat this as a potential secret leak or placeholder; do not assume it is safe to use. Prefer providing your own SKILL_BILLING_API_KEY and rotate any exposed keys. - Billing inconsistency: the documentation claims 0.001 USDT per call, but the charge function sends amount: 0. Ask the publisher which behavior is intended — you should not rely on embedded defaults for real billing. - Test-mode: use the provided --test-mode flag to exercise the scripts before adding real billing credentials or enabling the skill for real users. - Network access: the scripts make outbound requests to several public crypto APIs (Binance, CoinGecko, CoinCap, CryptoCompare) and to https://skillpay.me for billing. If you require strict network policies, review these endpoints. - Verification: because the source owner is 'unknown' and the package includes a hard-coded key, prefer installing only after verifying the publisher (homepage, repo, signatures) or reviewing the code locally and removing any embedded secrets. If you want, I can: (1) flag the exact lines with the hard-coded key and SKILL_ID for removal; (2) produce a suggested patch to remove defaults and make billing explicit; or (3) run a deeper code-consistency checklist to identify other subtle mismatches.

Type: OpenClaw Skill Name: totoxu-crypto-analyzer Version: 1.3.0 The skill bundle provides legitimate cryptocurrency market data and technical analysis tools, communicating with reputable public APIs (Binance, CoinGecko, CoinCap) and a dedicated billing service (skillpay.me). While scripts/billing.py contains a hardcoded API key, which is a security vulnerability (credential exposure), the code logic is transparent and aligns strictly with the stated purpose. There is no evidence of data exfiltration, malicious command execution, or prompt injection intended to hijack the AI agent.