aicoin-account
Pass
Audited by Gen Agent Trust Hub on May 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/exchange.mjsfile utilizesexecSyncto automatically invokenpm install. This is a self-provisioning mechanism designed to ensure the necessaryccxtdependency is available in the local environment without manual user intervention. - [EXTERNAL_DOWNLOADS]: The skill performs an external download of the
ccxtlibrary from the official NPM registry when it detects the package is missing. This is handled during the execution ofscripts/exchange.mjsusing standard Node.js package management tools. - [DATA_EXPOSURE]: The skill implements a systematic search for
.envfiles across standard local directories (project root and OpenClaw configuration paths) to load sensitive credentials. This localized secret management ensures that exchange API keys and AiCoin access tokens remain on the user's machine. - [EXTERNAL_DOWNLOADS]: The skill includes a hardcoded public access key and secret in
lib/defaults.json. These credentials provide fallback access to the AiCoin free-tier API, allowing the skill to function for market data queries even before a user configures personal keys. - [REMOTE_CODE_EXECUTION]: The
scripts/exchange.mjsscript uses dynamicimport()to load theccxtlibrary after installation. This is a standard programmatic method for handling optional or late-bound dependencies in ES modules.
Audit Metadata