aicoin-account

Pass

Audited by Gen Agent Trust Hub on May 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/exchange.mjs file utilizes execSync to automatically invoke npm install. This is a self-provisioning mechanism designed to ensure the necessary ccxt dependency is available in the local environment without manual user intervention.
  • [EXTERNAL_DOWNLOADS]: The skill performs an external download of the ccxt library from the official NPM registry when it detects the package is missing. This is handled during the execution of scripts/exchange.mjs using standard Node.js package management tools.
  • [DATA_EXPOSURE]: The skill implements a systematic search for .env files across standard local directories (project root and OpenClaw configuration paths) to load sensitive credentials. This localized secret management ensures that exchange API keys and AiCoin access tokens remain on the user's machine.
  • [EXTERNAL_DOWNLOADS]: The skill includes a hardcoded public access key and secret in lib/defaults.json. These credentials provide fallback access to the AiCoin free-tier API, allowing the skill to function for market data queries even before a user configures personal keys.
  • [REMOTE_CODE_EXECUTION]: The scripts/exchange.mjs script uses dynamic import() to load the ccxt library after installation. This is a standard programmatic method for handling optional or late-bound dependencies in ES modules.
Audit Metadata
Risk Level
SAFE
Analyzed
May 1, 2026, 11:18 AM