Is kuns9/upbit-market-data-skill safe?
Yes. kuns9/upbit-market-data-skill is safe to install. Oathe's behavioral security audit gave the upbit-market-data-skill skill by kuns9 a trust score of 89/100 with 4 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/kuns9/upbit-market-data-skill
Is kuns9/upbit-market-data-skill safe to install?
This is a legitimate Node.js CLI tool for fetching cryptocurrency market data from Upbit exchange API. The code is well-structured with no evidence of malicious behavior, though it requires API credentials and makes external network requests as expected for its functionality.
What security issues were found in kuns9/upbit-market-data-skill?
Category Scores
Findings (4)
INFO Canary file access detected -10 ▶
Sensitive canary files (.env, SSH keys, AWS credentials) were accessed during audit period, but timestamp analysis shows this occurred before skill installation, indicating monitoring system activity
LOW API credential requirement -7 ▶
Skill requires Upbit API credentials (accessKey/secretKey) for authenticated operations, which could be misused if system is compromised, though no evidence of credential misuse in code
INFO Sensitive file monitoring alerts -10 ▶
Monitoring detected access to honeypot files, but files remained intact and timing suggests system-level activity rather than skill-induced access
LOW External API dependencies -5 ▶
Skill makes network requests to cryptocurrency exchange API, which is expected behavior but creates external dependencies
Should I install kuns9/upbit-market-data-skill?
Oathe's verdict for kuns9/upbit-market-data-skill is SAFE with a trust score of 89/100. Recommendation: Install.