ClawAudit verdict
crypto-regime-report
The skill generates market regime reports for crypto perpetuals using technical indicators. While it seems legitimate, it does involve network activity which could potentially be risky if not properly validated.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (5)
Possible hardcoded credential
scripts/alert_poller.sh · prose · downgraded · TOKEN="${TELEGRAM_BOT_TOKEN:-}
Accesses OpenClaw config/secrets directly
SKILL.md · prose · downgraded · ~/.openclaw/openclaw.json
subprocess execution — runs system commands from Python
scripts/regime_report.py · prose · downgraded · subprocess.run(
Python os.environ.get — reads environment variable
scripts/regime_report.py · prose · downgraded · os.environ.get(
Popular HTTP library — network access
scripts/regime_report.py · prose · downgraded · Got
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class D). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
Requires 2 system binaries. (1 elevated: curl).
network_out Is this flag fair?
Thanks — recorded.