中文 EN

Scan Report

Scan New Files

⚠ Suspicious — Risk Score 35/100
Last scan:2 days ago Rescan
35 /100
whale-alert-monitor
Cryptocurrency whale wallet alert monitoring assistant — tracks large transfers, exchange flows, and whale positions
Hardcoded billing API key exposed in source code; payment.py makes undeclared external network calls to skillpay.me that are not mentioned in SKILL.md; all scripts use mock/simulated data with no real blockchain APIs called.
Skill Namewhale-alert-monitor
Duration75.7s
Enginepi
⚠
Use with caution
Remove hardcoded BILLING_API_KEY from payment.py and use os.getenv('SKILLPAY_API_KEY') instead. Add network:WRITE to declared capabilities. Consider whether payment.py is actually invoked at skill runtime, since scripts use mock data.

Findings 6 items

Severity Finding Location
High
Hardcoded billing API key in payment.py
BILLING_API_KEY is defined as a string literal on line 12 of payment.py and transmitted in the X-API-Key header to https://skillpay.me. If this file is exposed (e.g., through skill publication, debugging, or a supply-chain attack), the key can be stolen and abused for billing fraud. This key is not pinned to an environment variable as best practice requires.
BILLING_API_KEY = "sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2"
→ Replace with: BILLING_API_KEY = os.getenv('SKILLPAY_API_KEY', '') and require the environment variable to be set.
 payment.py:12
Medium
Undeclared external network calls in payment.py
SKILL.md declares network usage only for Telegram/Discord notifications. However, payment.py silently makes HTTP GET/POST requests to https://skillpay.me during verify_payment() and charge_user(). The skill payload (payment.py) is included in the published skill but its external network behavior is not documented.
resp = requests.get(f"{BILLING_API_URL}/api/v1/billing/balance", params={"user_id": user_id}, headers=HEADERS, timeout=10)
→ Document all external domains (skillpay.me) in SKILL.md. Add network:WRITE to declared capabilities. Alternatively, decouple billing from the skill runtime.
 payment.py:26
Medium
Silent payment enforcement on skill invocation
require_payment() in payment.py raises SystemExit if balance is insufficient. This means the skill refuses to function without payment, but this behavior is only visible as an inline comment in SKILL.md, not as a declared dependency or pre-condition.
raise SystemExit("Payment required")
→ Document the payment requirement prominently in SKILL.md with a dedicated section, including the billing provider and pricing model.
 payment.py:88
Low
Environment variable access not declared
Multiple scripts read API keys and tokens from os.environ (ETHERSCAN_API_KEY, TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, DISCORD_WEBHOOK_URL) but SKILL.md does not declare environment:READ as a capability.
self.api_key = os.getenv('ETHERSCAN_API_KEY')
→ Add environment:READ to declared capabilities and list all required environment variables in SKILL.md.
 whale_tracker.py:17
Low
File write operations not declared
Scripts write to local files (whale_profile.json, alert_history.json, whale_monitor.log) but filesystem:WRITE is not declared in SKILL.md.
with open(filename, 'w') as f: json.dump(data, f, indent=2)
→ Add filesystem:WRITE to declared capabilities if file writes are intentional at runtime.
 whale_tracker.py:231
Info
All scripts use mock/simulated data
No script makes actual Etherscan, Alchemy, or Moralis API calls. All data is generated via random number generation. The ETHERSCAN_API_KEY read from environment is never used. This reduces the real-world risk but raises questions about the skill's utility.
# 生成10-30笔交易; for i in range(random.randint(10, 30))
→ Either implement real API integration or clearly label the scripts as demonstration/mock tools.
 whale_tracker.py:67
ResourceDeclaredInferredStatusEvidence
Network READ READ+WRITE ✗ Violation payment.py:15 — requests.post to skillpay.me with API key
Environment NONE READ ✗ Violation whale_tracker.py:17 — os.getenv('ETHERSCAN_API_KEY'); alert_manager.py:105 — os.…
Filesystem NONE READ+WRITE ✗ Violation whale_tracker.py:231 — open(filename,'w'); monitor_daemon.py:44 — logging.FileHa…
Shell NONE NONE — No subprocess or shell execution found
1 High 24 findings
🔑
High API Key 疑似硬编码凭证
API_KEY = "sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2"
payment.py:12
💰
Medium Wallet Address 加密货币钱包地址
0x742d35Cc6634C0532925a3b8D4E6D3b6e8d3e8D3
SKILL.md:78
💰
Medium Wallet Address 加密货币钱包地址
0x3f5CE5FBFe3E9af3971dD833D26bA9b5C936f0bE
SKILL.md:96
💰
Medium Wallet Address 加密货币钱包地址
0x71660c4005BA85c37ccec55d0C4493E66Fe775d3
SKILL.md:101
🔗
Medium External URL 外部 URL
https://skillpay.me
payment.py:11
🔗
Medium External URL 外部 URL
https://api.etherscan.io/api
references/api-configuration.md:8
🔗
Medium External URL 外部 URL
https://eth-mainnet.g.alchemy.com/v2/
references/api-configuration.md:54
🔗
Medium External URL 外部 URL
https://deep-index.moralis.io/api/v2/
references/api-configuration.md:89
🔗
Medium External URL 外部 URL
https://eth-mainnet.g.alchemy.com/v2/KEY
references/api-configuration.md:112
🔗
Medium External URL 外部 URL
https://eth-mainnet.g.alchemy.com/v2/$
references/api-configuration.md:137
🔗
Medium External URL 外部 URL
https://etherscan.io
references/api-configuration.md:138
🔗
Medium External URL 外部 URL
https://bsc-dataseed.binance.org
references/api-configuration.md:142
🔗
Medium External URL 外部 URL
https://bscscan.com
references/api-configuration.md:143
🔗
Medium External URL 外部 URL
https://arb-mainnet.g.alchemy.com/v2/$
references/api-configuration.md:147
🔗
Medium External URL 外部 URL
https://arbiscan.io
references/api-configuration.md:148
🔗
Medium External URL 外部 URL
https://opt-mainnet.g.alchemy.com/v2/$
references/api-configuration.md:152
🔗
Medium External URL 外部 URL
https://optimistic.etherscan.io
references/api-configuration.md:153
💰
Medium Wallet Address 加密货币钱包地址
0xdB3c617cDd2fBf0c8611C04A49d34C7B332e2BB6
references/wallet-labels.md:8
💰
Medium Wallet Address 加密货币钱包地址
0x5a52E96BAcdaBb82fd05763E25335261B270Efcb
references/wallet-labels.md:9
💰
Medium Wallet Address 加密货币钱包地址
0x503828976D22510aad0201ac7EC88293211D23Da
references/wallet-labels.md:15
💰
Medium Wallet Address 加密货币钱包地址
0x6b75d8AF000000e20B7a7DD000000090D0000000
references/wallet-labels.md:20
💰
Medium Wallet Address 加密货币钱包地址
0xf89d7b9c864f589bbF53f821d7EfC68c91d70958
references/wallet-labels.md:25
💰
Medium Wallet Address 加密货币钱包地址
0x2B6eD29a95753C3Ad948348e3e7b1A251039FBB9
references/wallet-labels.md:30
🔗
Medium External URL 外部 URL
https://api.telegram.org/bot
scripts/alert_manager.py:149

File Tree

11 files · 74.5 KB · 2441 lines
Python 7f · 1864L Markdown 3f · 558L JSON 1f · 19L
├─ ▾ 📁 references
│ ├─ 📝 api-configuration.md Markdown 181L · 2.9 KB
│ └─ 📝 wallet-labels.md Markdown 90L · 1.5 KB
├─ ▾ 📁 scripts
│ ├─ 🐍 alert_manager.py Python 303L · 9.9 KB
│ ├─ 🐍 exchange_flow.py Python 311L · 10.6 KB
│ ├─ 🐍 holding_analyzer.py Python 283L · 9.5 KB
│ ├─ 🐍 monitor_daemon.py Python 246L · 7.9 KB
│ ├─ 🐍 transfer_monitor.py Python 300L · 9.6 KB
│ └─ 🐍 whale_tracker.py Python 279L · 9.9 KB
├─ 📋 _meta.json JSON 19L · 440 B
├─ 🐍 payment.py Python 142L · 5.2 KB
└─ 📝 SKILL.md Markdown 287L · 6.9 KB

Dependencies 2 items

PackageVersionSourceKnown VulnsNotes
requests * pip No Version not pinned; used for billing and notification HTTP calls
pyyaml * pip No Used for config loading in monitor_daemon.py

Security Positives

✓ No subprocess, shell, or eval() execution found anywhere in the codebase
✓ No credential harvesting from ~/.ssh, ~/.aws, or other sensitive paths
✓ No base64-encoded payloads or obfuscated code
✓ No curl|bash or wget|sh remote script execution
✓ Notification channels (Telegram/Discord) use environment variables, not hardcoded tokens
✓ No hidden instructions in HTML comments or documentation
✓ Scripts are well-structured Python with clear logging