by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's metadata and instructions are inconsistent and vague (e.g., lists curl and 'primaryEnv: bash' but contains no runnable instructions or install artifacts), so it may not be what it claims without further details.
评估建议
The skill's metadata and README are inconsistent and lack operational detail. Before installing or paying: (1) ask the publisher for the actual install package or source code and a list of endpoints the skill will contact, (2) request a clear setup guide showing how 24/7 automation is achieved and what credentials (if any) are required, (3) verify why 'curl' is needed and where network requests go, and (4) run any untrusted package only in an isolated/sandbox environment and consider asking for ...详细分析 ▾
⚠ 用途与能力
The skill claims on-chain + technical indicator trading signals and 24/7 automation, but the manifest only requires the curl binary and declares a 'primaryEnv' of 'bash' (which is not a typical environment variable/credential). There is no explanation why curl is required or why 'bash' is declared as a credential. These mismatches are not proportional to the stated purpose and suggest sloppy or misleading metadata.
⚠ 指令范围
SKILL.md contains marketing claims (pricing, expected returns, 24x7 operation) and an example install command, but provides no runtime instructions, no commands to run, no endpoints to contact, and no configuration or credential guidance. The instructions are vague and do not enable the claimed continuous automation; that lack of concrete scope gives the implementer broad discretion and is concerning.
✓ 安装机制
There is no install spec and no code files to be written or executed by the installer (instruction-only). That minimises direct install risk. However, the README references 'clawhub install' which could pull additional artifacts elsewhere — this skill bundle itself has no install payload.
⚠ 凭证需求
requires.env is empty (no secrets requested), yet primaryEnv is set to 'bash' (not an environment variable name) which is incoherent. The only declared runtime dependency is curl, but SKILL.md never uses it or explains why network access or specific credentials would be needed. This inconsistency could hide later requirements during a separate install step.
✓ 持久化与权限
The skill is not always-enabled and is user-invocable with normal autonomous invocation allowed. It does not request persistent system-wide privileges or configuration changes in the provided files.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/23
Initial release of trading-signal-pro: - Provides automated trading signal analysis using on-chain data and technical indicators - Runs 24/7 with API integration for major platforms - Offers flexible configuration and real-time monitoring with automatic optimization - Easy installation via clawhub - Details pricing, expected return, and break-even period
● 可疑
安装命令 点击复制
官方npx clawhub@latest install trading-signal-pro
镜像加速npx clawhub@latest install trading-signal-pro --registry https://cn.clawhub-mirror.com
技能文档
交易信号分析 - 链上数据 + 技术指标
价格：$350 USDC
功能特性
- 自动化执行，7x24 小时运行
- API 集成，支持主流平台
- 配置灵活，易于定制
- 实时监控，自动优化
安装方式
clawhub install trading-signal-pro
使用示例
详见文档收益潜力
- 预期月收益：$700-$((350 * 4))
- 回本周期：1-2 个月
- 边际成本：几乎为零
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制