Real-time crypto market intelligence briefing. One command gives any agent the full picture: market regime, fear/greed, BTC/ETH dominance, gas costs, trendin...
Security Analysis
medium confidenceThe skill's requests and runtime behavior align with its stated purpose (real‑time crypto market briefings); it fetches public market APIs and a paid SUPAH endpoint and requires only curl/node and the optional SUPAH_API_BASE override — but it performs automated micropayments (x402) to an external address and comes from an unknown source, so review payment/trust before use.
Name/description (crypto market intelligence) match the declared requirements and included script: curl and node are used to fetch and parse market data; SUPAH_API_BASE overrides the API base. The listed external services (CoinGecko, Alternative.me, DeFiLlama, Moralis) are exactly the APIs the skill calls.
SKILL.md and scripts confine actions to fetching market data from the declared endpoints, parsing results, and printing a briefing. The script only reads files it creates in a temporary directory and writes a /tmp/market-pulse-result.json in the payment-required branch. There is no access to unrelated local files, wide environment enumeration, or hidden exfiltration code, but the skill performs network calls and relies on an on‑chain micropayment flow that your agent/wallet will execute automatically.
No install spec; this is instruction-only with an included shell script and inline node parsing. Nothing is downloaded from arbitrary URLs at install time and no archives are extracted — low install risk.
Only SUPAH_API_BASE is declared (to override the default https://api.supah.ai). No API keys or secrets are requested by the skill. However, the skill expects your agent to perform x402 micropayments (USDC on Base) automatically; having funds in an agent-controlled wallet is required and can result in charges ($0.03 per call). Ensure you understand which wallet the agent will use and trust the payment destination.
The skill is not always-enabled and does not request elevated privileges or modify other skills or agent-wide configs. Autonomous invocation is allowed by default (expected) but not combined with other concerning privileges.
Guidance
This skill is internally consistent for providing a paid market briefing, but review these before installing: 1) Cost and payments — each call triggers an x402 USDC micropayment (default $0.03) to an on‑chain payTo address; confirm you accept these charges and that the agent will use a wallet you control. 2) Trustworthiness of api.supah.ai — the skill comes from an unknown source; verify the service and the owner before sending funds or using it for trading decisions. 3) Test safely — run the script in a sandbox or with no funds (or with SUPAH_API_BASE pointed to a test endpoint) to confirm behavior. 4) Privacy & risk — the skill makes outbound network calls to multiple public APIs and a paid backend that aggregates data; do not pass private keys, secrets, or other sensitive data into the skill. If you need higher assurance, obtain provenance for the publisher and confirm the payment address and API behavior out-of-band before trusting automated payments.
Latest Release
v2.3.0
Clean x402 only publish.
Popular Skills
Published by @supah-based on ClawHub
