Skill Trust Decision
dex-price-monitor
DEX价格监控工具功能正常，但存在硬编码API密钥的安全隐患，属于供应链风险。代码逻辑清晰，无恶意行为迹象。
Why this conclusion was reached
2/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 0 attack-chain steps and 1 severe findings.
Review
Dependencies and supply chain hygiene
2 dependency or supply-chain issues need attention.
What drove the risk score up
硬编码API密钥 +15
payment.py:12 硬编码 BILLING_API_KEY，生产环境暴露风险
外部支付服务调用 +5
未声明的外部服务调用 (skillpay.me)，需要验证合法性
无版本锁定的第三方依赖 +5
使用 requests 库但无版本控制，存在依赖劫持风险
Most important evidence
High Credential Theft
硬编码 API 密钥
payment.py 第12行硬编码了计费 API 密钥 'sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2'。如果此 skill 被部署，密钥将随代码分发，可能被滥用。
payment.py:12 将密钥存储在环境变量 SKILLPAY_API_KEY 中，代码中读取 os.environ.get('SKILLPAY_API_KEY')
Medium Supply Chain
第三方依赖无版本锁定
代码使用 requests、matplotlib 等第三方库但未声明版本，可能受到依赖劫持攻击。
scripts/spread_tracker.py, scripts/best_path_finder.py:1 添加 requirements.txt 或使用 poetry/poetry.lock 锁定依赖版本
Medium Doc Mismatch
外部支付服务未在文档声明
SKILL.md 提到 SkillPay 付费系统但未详细说明该服务。payment.py 调用 skillpay.me 进行计费，属于未充分声明的外部依赖。
SKILL.md:11 在 SKILL.md 中明确说明支付服务提供商、数据流向和隐私政策
Low Sensitive Access
Telegram/Discord Webhook 环境变量读取
price_alerts.py 读取 TELEGRAM_BOT_TOKEN 和 DISCORD_WEBHOOK_URL 环境变量用于通知功能。
scripts/price_alerts.py:91 这是正常功能，确保这些令牌不会外传
Declared capability vs actual capability
Network Pass
Declared READ
→ Inferred READ
所有脚本使用 requests 调用公开 API (CoinGecko, 1inch, 0x, ParaSwap 等) Filesystem Pass
Declared READ
→ Inferred WRITE
多个脚本保存 JSON 数据到本地 (price_alerts.json, reports/) Environment Pass
Declared NONE
→ Inferred READ
price_alerts.py 读取 TELEGRAM_BOT_TOKEN, DISCORD_WEBHOOK_URL Suspicious artifacts and egress
High API Key
API_KEY = "sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2" payment.py:12
Medium External URL
https://api.1inch.io/ SKILL.md:105
Medium External URL
https://api.0x.org/ SKILL.md:106
Medium External URL
https://api.paraswap.io/ SKILL.md:107
Medium External URL
https://api.coingecko.com/ SKILL.md:112
Medium External URL
https://pro-api.coinmarketcap.com/ SKILL.md:113
Medium External URL
https://min-api.cryptocompare.com/ SKILL.md:114
Medium External URL
https://skillpay.me payment.py:11
Medium External URL
https://api.telegram.org/bot references/alert-configuration.md:91
Medium External URL
https://dexscreener.com/ethereum/0x8ad599c3A0ff1De082011EFDDc58f1908eb6e6D8 references/alert-configuration.md:121
Medium Wallet Address
0x8ad599c3A0ff1De082011EFDDc58f1908eb6e6D8 references/alert-configuration.md:121
Medium External URL
https://your-app.com/webhook references/alert-configuration.md:214
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| requests | * | pip | No | 无版本锁定，存在依赖劫持风险 |
| matplotlib | * | pip | No | 可选依赖，用于图表绘制 |
File composition
12 files · 3846 lines
Markdown 5 files · 1963 linesPython 6 files · 1864 linesJSON 1 files · 19 lines
Files of concern · 8
scripts/price_alerts.py Telegram/Discord Webhook 环境变量读取
scripts/best_path_finder.py https://api.0x.org/swap/v1/quote · https://api.paraswap.io/prices · https://portal.1inch.dev/
references/api-documentation.md https://api.coingecko.com/api/v3/simple/price · https://api.coingecko.com/api/v3/coins/ · https://api.1inch.dev/swap/v5.2/ · 0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE · 0xA0b86a33E6441E6C7D3D4B4f6B7A2c8D5e9F0123 · https://api.0x.org/swap/v1/price · https://api.0x.org/swap/v1/sources · https://api.dexscreener.com/latest/dex/tokens/ · 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2 · https://api.dexscreener.com/latest/dex/search
references/alert-configuration.md https://api.telegram.org/bot · https://dexscreener.com/ethereum/0x8ad599c3A0ff1De082011EFDDc58f1908eb6e6D8 · 0x8ad599c3A0ff1De082011EFDDc58f1908eb6e6D8 · https://your-app.com/webhook · [email protected]
references/data-sources.md https://api.thegraph.com/subgraphs/name/uniswap/uniswap-v3 · https://api.thegraph.com/subgraphs/name/sushiswap/exchange · https://api.thegraph.com/subgraphs/name/curvefi/curve · https://api.thegraph.com/subgraphs/name/balancer-labs/balancer-v2 · https://eth.llamarpc.com · https://pro-api.coinmarketcap.com/v1/cryptocurrency/quotes/latest
SKILL.md 外部支付服务未在文档声明 · https://api.1inch.io/ · https://api.0x.org/ · https://api.paraswap.io/ · https://api.coingecko.com/ · https://pro-api.coinmarketcap.com/ · https://min-api.cryptocompare.com/
references/monitoring-tools.md https://dexscreener.com/ · https://www.tradingview.com/ · https://apy.vision/ · https://dune.com/ · https://defillama.com/ · https://yields.llama.fi/pools · https://eigenphi.io/ · https://api.coingecko.com/api/v3/simple/price?ids=ethereum&vs_currencies=usd · https://rpc.ankr.com/eth · https://ethereum.publicnode.com · https://arb1.arbitrum.io/rpc · https://arbitrum.llamarpc.com · https://chainlist.org/
payment.py 硬编码 API 密钥 · API_KEY = "sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2" · https://skillpay.me
Other files · historical_analyzer.py · realtime_monitor.py · spread_tracker.py · _meta.json
Security positives
代码结构清晰，无混淆或隐藏代码
无恶意行为迹象（无反向 shell、无数据外泄代码）
使用标准公开 API，数据来源可验证
价格监控逻辑合理，无异常算法
所有网络请求目标为合法服务
无文件系统越权访问
无环境变量敏感信息收割