Crypto trading signal, price prediction, market analysis for any Binance pair (BTC, ETH, SOL, USDT...). Trigger on: crypto, signal, buy, sell, "should I buy"...
Security Analysis
medium confidenceThe skill mostly does what it says (fetches market data and news, produces signals) but the declared registry requirements omit required API credentials and there are small inconsistencies you should review before installing.
Name/description match the included Python script: it fetches Binance klines and news, computes indicators and writes signal JSON. However, the registry metadata declares no required env vars/credentials while SKILL.md and the script require a NewsAPI key (NEWSAPI_KEY) and optionally other API keys — this mismatch is suspicious and should be clarified.
SKILL.md instructions are scoped to running the script, reading/writing local signal JSON files, and using NewsAPI/CryptoPanic/Binance endpoints. The instructions do not ask to read unrelated system files or exfiltrate arbitrary data; they explicitly require only certain JSON fields when reading files.
No install spec (instruction-only plus bundled script). Nothing is downloaded or executed at install time; the risk surface is limited to the included script which runs when invoked.
The registry lists no required env vars, but SKILL.md and the script expect NEWSAPI_KEY (required) and optionally CRYPTOPANIC_KEY, BINANCE_API_KEY and proxy env vars. Binance endpoints used are public (do not strictly require an API key), so requiring a BINANCE_API_KEY is questionable. The script will create a credentials file at ~/.openclaw/credentials/crypto-signal.json (containing API keys) — that persistent credential storage is reasonable but you should verify where keys are stored and why the registry omitted them.
The skill does not request always:true and does not modify other skills or system-wide configs. It will create its own credentials file and write outputs under the skill workspace and ~/.openclaw; this is expected behavior for a local skill.
Guidance
This skill appears to implement the described crypto signal pipeline, but the package metadata omitted that an API key (NewsAPI) is required and the script will create a credentials file at ~/.openclaw/credentials/crypto-signal.json. Before installing or running: (1) inspect the full script yourself (or run it in a sandbox) to confirm there are no hidden network endpoints; (2) only provide the minimum keys needed (NewsAPI key), do not supply exchange/withdrawal credentials; (3) be aware the skill will make outbound requests to Binance, NewsAPI, and CryptoPanic and will write signals/data under the skill workspace and ~/.openclaw; (4) if you need guarantees, ask the publisher to update registry metadata to declare required env vars and explain why BINANCE_API_KEY would be needed. If you lack confidence in the source (owner/homepage unknown), run it in an isolated environment or decline.
Latest Release
v1.0.5
Version 1.0.5 of my-crypto-signal-skill - No file changes detected in this release. - Functionality, rules, setup, usage, scoring, and scheduler information remain unchanged.
Popular Skills
Published by @k2-l on ClawHub
