每4小时输出一次 BTC/ETH 行情复盘与可执行建议。基于 crypto-market-analyzer 的最新4h+1d数据，给出欧易（OKX）合约与现货网格的手填参数（区间、触发条件、止损止盈、仓位建议）。当用户要求“每4小时分析”“给欧易手填参数”“合约+网格参数建议”时使用。
Security Analysis
medium confidenceThe skill's instructions expect a local tool (crypto-market-analyzer) at a hard-coded path that is not provided or declared, which is incoherent and could lead to executing arbitrary local code; otherwise the skill's permissions are minimal.
The skill claims to produce 4-hour BTC/ETH briefs using 'crypto-market-analyzer' data, but it does not include that analyzer, declare it as a dependency, or provide an install step. Instead it references a hard-coded absolute path (/home/hmzo/.openclaw/workspace/skills/public/crypto-market-analyzer/...) to a script outside the skill bundle — a mismatch between claimed capability and what is actually provided.
Runtime instructions tell the agent to execute a local Python script at a specific absolute path. Executing that script could perform any file I/O or network activity (the SKILL.md assumes the script will output specific JSON fields). The instructions otherwise stay focused on analyzing structured JSON from that script and producing trade templates, but they grant the agent the ability to run unverified code from the host filesystem and assume data fields that are not validated within the skill.
There is no install spec and no external packages are fetched by the skill itself (instruction-only). That minimizes supply-chain risk from the skill package, but shifts risk to the referenced external script which is not included.
The skill requests no environment variables, credentials, or config paths. This is proportionate to its stated purpose of producing trade parameters and is preferable from a secrets perspective. However, it still depends on a local script whose access requirements are unknown.
The description says 'output every 4 hours', but the skill has no scheduling metadata or 'always' flag. Autonomous invocation is allowed by default on the platform, so the skill could be invoked periodically by an agent, but the skill package itself does not request elevated persistence. Confirm how scheduling is intended to be implemented.
Guidance
This skill is suspicious mainly because it expects a local tool at a hard-coded path that is not included or declared. Before installing or enabling it: 1) ask the publisher to include the crypto-market-analyzer dependency or provide a clear, trusted install step (or change the script path to a relative, bundled script). 2) If you must run it, inspect the referenced Python script's contents to ensure it doesn't read unrelated files or exfiltrate data. 3) Prefer running the analyzer in a sandbox or CI environment you control, not directly from an agent with broad filesystem access. 4) Clarify how the 'every 4 hours' scheduling will be implemented and consider disabling autonomous invocation until you trust the script. 5) If you don't control the environment where the referenced path exists, do not enable this skill because it will fail or might run unexpected local code.
Latest Release
v1.0.1
sync updates
More by @hmzo
Published by @hmzo on ClawHub
