Crypto news search, AI ratings, trading signals, and real-time updates via the OpenNews 6551 API. Supports keyword search, coin filtering, source filtering,...
Security Analysis
medium confidenceThe skill is coherent with its stated purpose (querying the OpenNews 6551 API) and only requests a single API token and curl; minor metadata inconsistencies exist but there is no evidence of malicious behavior.
The name/description (crypto news, AI ratings, trading signals) match the SKILL.md which shows curl-based calls to https://ai.6551.io and requires OPENNEWS_TOKEN. Asking for a bearer token and curl is appropriate for an HTTP API client.
SKILL.md instructs only to call specific REST endpoints with Authorization: Bearer $OPENNEWS_TOKEN and examples use jq for local filtering. It does not ask the agent to read unrelated local files or exfiltrate data. Note: some examples use jq, but jq is not declared in the skill metadata's required binaries (minor scope/declared-dependency mismatch).
Install spec only lists a brew formula for curl — curl is a standard, low-risk dependency. The brew-only install entry is fine for macOS but won't apply on all declared OSes (linux, win32). No arbitrary downloads or extract steps are present.
Only OPENNEWS_TOKEN is required (primary credential). That is proportional to an API client that needs a bearer token. No unrelated credentials or broad environment access are requested.
The skill is not always-enabled and does not request elevated or persistent system privileges. It does not modify other skills or system-wide config per the provided files.
Guidance
This skill appears to do what it says: run curl against ai.6551.io using your OPENNEWS_TOKEN. Before installing, verify the token provider (https://6551.io/mcp) and consider: 1) only give a token with minimal scope/permissions, 2) if you intend to run the example pipelines, install jq locally (examples use it) — the skill's metadata is inconsistent about jq, 3) brew install is macOS-centric; on Linux/Windows ensure curl is present from your platform package manager, and 4) if you need higher assurance, verify the upstream project (package.json homepage points to a GitHub repo) or test the skill in an isolated environment.
Latest Release
v0.1.0
Initial release of OpenNews crypto news skill. - Search and filter crypto news by keyword, coin, source, and category via the OpenNews 6551 API. - View AI-powered article ratings, trading signals, and summaries. - Supports real-time news feeds over WebSocket. - Requires an API token (`OPENNEWS_TOKEN`) for authentication. - Includes common workflows and cURL examples for market overviews and high-impact news filtering.
More by @infra403
Published by @infra403 on ClawHub
