Upbit Trading Skill

Upbit 실시간 트레이딩 봇 - GLM AI 분석, 기술지표, 자동매매

This skill is internally inconsistent and presents a shell-execution risk. Before installing or running it: 1) Do not run it on a machine with sensitive data or credentials until you audit the code and the ../zai/ask.sh script it calls; that script will be executed by the bot. 2) Treat positions.json/events.json as untrusted input — an attacker who can edit those files could inject shell metacharacters into prompts that are passed to ask.sh, enabling command injection. 3) The package metadata omitted required env vars (UPBIT_ACCESS_KEY / UPBIT_SECRET_KEY) — expect to provide API keys for Upbit; store them securely. 4) The README promises Telegram alerts and an analyze.js file that are missing — contact the author or require corrected source before using for live trading. 5) If you want to proceed, fix the code first: remove execSync use or pass arguments safely (avoid shell interpolation), sanitize any data read from local files before embedding in shell commands, explicitly declare required env vars in metadata, and ensure all external dependencies (ask.sh, GLM runtime) are known and trustworthy. If you cannot verify those points, do not run this skill with real API keys or on production systems.

Type: OpenClaw Skill Name: upbit-trading-skill Version: 1.0.0 The `realtime-bot.js` file uses `child_process.execSync` to execute an external shell script `./ask.sh` located in a parent directory (`../zai`). The content of `ask.sh` is not provided, making its behavior unknown and introducing a significant supply chain risk and potential arbitrary command execution vector. While the stated purpose is to interact with an AI model (GLM), the mechanism of calling an unverified external script is highly suspicious.