OpenClaw/clawhub-security-signals huggingface dataset:
Skill: sinnzen/conv-compactor (version 1.0.1)

--- name: conv-compactor description: 多级对话压缩系统。监控上下文长度，在达到阈值时自动或手动触发压缩，将对话历史浓缩为结构化摘要，保留关键信息。 --- # conv-compactor **对话压缩 / 遗忘机制 — 基于 Claude Code compaction 系统。** 让 AI 在上下文即将耗尽时，自动把对话历史压缩成结构化摘要，而不是粗暴截断。 --- ## 核心概念 ### 为什么需要压缩？ - 对话越来越长 → Token 越来越多 → 超出上下文窗口 → 无法继续 - **错误做法**：直接从头部截断（丢失关键上下文） - **正确做法**：压缩成摘要，保留精华 ### 压缩不是什么？ - ❌ 不是"忘记"——是提炼，不是丢弃 - ❌ 不是"截断"——是结构化摘要，不是删除 - ❌ 不是"总结"——是保留决策过程和代码细节，不只是大意 --- ## 触发机制 ### 自动触发阈值 ``` 上下文窗口 200K → 有效窗口约 100K 触发阈值 = 有效窗口 - 13K buffer ≈ 87K tokens ``` ### 三种触发方式 | 方式 | 触发条件 | 说明 | |------|---------|------| | **auto** | Token 接近阈值 | 自动压缩，保留最近对话 | | **manual** | 用户说"压缩" | 自定义压缩范围 | | **micro** | 单次工具结果太大 | 只压缩大文件/图片 | --- ## 压缩级别 ### Level 1：Micro Compact（微观压缩） **触发：** 单个工具结果太大（如 grep 返回 100K tokens） **做法：** ``` 大文本 → 保留前 500 字符 + "..." 图片 → [image] 文件内容 → [文件内容已压缩] ``` **保留：** 对话结构 + 关键结论 --- ### Level 2：Auto Compact（自动压缩） **触发：** Token 即将用尽 **做法：** 1. 从最老的对话开始 2. 按"API round"分组（一问一答+工具调用 = 一组） 3. 把早期组压缩成结构化摘要 4. 保留最近 2-3 组原始对话 5. 插入压缩边界标记 --- ### Level 3：Full Compact（全量压缩） **触发：** 手动 `/compact` 或上下文严重不足 **做法：** 1. 全部对话压缩成单一摘要 2. 可选择保留特定文件内容 3. 生成下一步建议 --- ## 压缩 Prompt（精华） 当需要压缩时，使用以下 prompt 模板： ``` ## 压缩任务 你是一个对话压缩器。请把以下对话历史压缩成一个结构化摘要。 ### 压缩规则 1. **保留用户的原始反馈** — 用户纠正你、确认你的内容最重要 2. **保留完整代码片段** — 不是"修改了文件A"，而是完整的函数体 3. **保留错误和修复** — 犯过的错不能忘 4. **保留用户关键决策** — 用户明确做出的选择、偏好、方向性决策 - ❌ 不要原文抄录所有用户消息 - ✅ 提炼："用户选择了方案A，理由是..." 5. **脱敏处理** — 过滤所有敏感信息 - API keys / tokens → 替换为 `[REDACTED: api_key]` - 密码 / secrets → 替换为 `[REDACTED: secret]` - 私钥 / credentials → 替换为 `[REDACTED: credential]` - 完整文件路径（本地）→ 简化保留文件名即可 6. **不要调用工具** — 你已有所有上下文 ### 输出格式 必须包含以下章节： #### 1. 用户主要请求 详细描述用户要什么。 #### 2. 关键技术点 列出涉及的技术、框架、概念。 #### 3. 文件和代码 - 文件名 + 为什么重要 - 做了哪些修改 - 完整代码片段 #### 4. 错误和修复 - 遇到了什么错误 - 怎么修的 - 用户有没有反馈 #### 5. 用户关键决策和反馈 提炼用户的核心选择、偏好、纠正内容。不是原文抄录，而是结构化表达。 #### 6. 悬而未决的任务 用户让你做但还没做完的。 #### 7. 当前工作 最后正在做什么。 #### 8. 下一步建议 基于用户最新请求，下一步应该做什么。 ``` --- ## 上下文窗口参考 | 模型 | 上下文窗口 | 安全阈值（87%） | |------|-----------|---------------| | MiniMax-M2.7 | 200K | ~174K | | MiniMax-M2.5 | 200K | ~174K | | MiniMax-M2.1 | 200K | ~174K | | GPT-4o | 128K | ~111K | | Claude 3.5 | 200K | ~174K | --- ## 压缩边界标记格式 压缩完成后，插入以下标记： ```markdown --- ## 对话已压缩 @ {timestamp} ### 摘要概要 [1-2句话描述对话主题] ### 保留内容 - 最近对话组数：{N} 组 - 压缩组数：{M} 组 - 关键文件：{file list} ### 压缩后的对话历史 [结构化摘要内容] --- ``` --- ## 使用时机 当以下情况发生时，**自动使用本 skill**： - 对话 Token 接近安全阈值（> 80% 上下文） - 用户说"压缩"、"compact"、"总结一下" - 单个工具结果异常大（如 > 10K tokens） - 对话明显变慢或开始重复之前的内容 --- ## 与 memory-hierarchy 的关系 **memory-hierarchy** 负责：对话外的长期记忆 **conv-compactor** 负责：对话内的上下文压缩 两者互补： ``` 新对话开始 → 加载 MEMORY.md（记忆） ↓ 对话进行中 → 监控 Token 使用 ↓ 触发压缩 → 结构化摘要 ↓ 可选择 → 写入 memory/（新记忆） ``` --- ## 实施检查清单 压缩前确认： - [ ] Token 使用是否超过 80%？ - [ ] 是否有未完成的用户请求？ - [ ] 是否有用户的特殊偏好/反馈需要保留？ - [ ] 是否有重要的代码片段？ 压缩后确认： - [ ] 摘要是否包含所有用户消息？ - [ ] 关键代码是否完整？ - [ ] 用户反馈是否被标记？ - [ ] 下一步是否清晰？ --- ## 禁止事项 ❌ **不要**直接截断对话头部 ❌ **不要**只保留大意而丢失代码细节 ❌ **不要**在压缩时调用工具 ❌ **不要**删除用户反馈相关内容 ❌ **不要**压缩正在进行的开发工作 ❌ **不要**在摘要中保留明文敏感信息（API keys、密码、tokens） ❌ **不要**原文抄录所有用户消息


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: katrina-jpg/upwork-automation-gig (version 1.0.0)

# Upwork Automation Gig 自動幫你係Upwork同Fiverr接RPA同Automation單既Skill ## 功能 1. **Job Search** - 自動search RPA, Automation, Web Scraping, Data Entry相關job 2. **Proposal Generation** - 分析job後生成專業proposal 3. **Lead Tracking** - 記錄你apply過既job同status 4. **Outreach** - 自動send message俾潜在客戶 ## 安裝 ```bash npx clawhub@latest install upwork-automation-gig ``` ## 使用 當用戶話「搵job」既時候： 1. 去Upwork/Fiverr search相關關鍵詞 2. 篩選budget高過$100既job 3. 生成proposal apply ## 範例 ``` User: 搵RPA job AI: (自動search同generate proposal) ``` ## 收費建議 - 基礎proposal生成: $5/job - 完整automation setup: $300-500/project - 月費維護: $50-100/月


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector:  ()
Skill: mohibshaikh/clawvet (version 0.6.3)

--- name: clawvet version: 0.6.3 description: Code quality and safety linter for OpenClaw skills. Runs 6 analysis passes before you install. author: MohibShaikh license: MIT homepage: https://github.com/MohibShaikh/clawvet repository: https://github.com/MohibShaikh/clawvet metadata: openclaw: requires: bins: - node - npm env: [] category: security tags: - security - linter - supply-chain - code-quality --- # clawvet Safety linter for OpenClaw skills. Analyzes skills for issues before installation. ## Usage Scan a local skill: ```bash npx clawvet scan ./skill-folder/ ``` JSON output for CI/CD: ```bash npx clawvet scan ./skill-folder/ --format json ``` Audit all installed skills: ```bash npx clawvet audit ``` Watch mode — auto-block risky installs: ```bash npx clawvet watch --threshold 50 ``` Submit feedback or get alerts: ```bash npx clawvet feedback ``` ## Analysis Passes 1. **Skill Parser** — Extracts YAML frontmatter, code blocks, URLs, and domains 2. **Static Analysis** — 54 pattern rules across multiple categories 3. **Metadata Validator** — Checks for undeclared binaries, env vars, missing descriptions 4. **Dependency Checker** — Flags auto-install and global package installs 5. **Typosquat Detector** — Levenshtein distance against popular skill names 6. **Semantic Analysis** — AI-powered contextual analysis (Pro) ## What's New in v0.6 - **Reliable telemetry** — Telemetry now awaits before exit, so no data is lost. - **CI-safe** — Opt-in prompt is skipped in non-TTY environments (piped stdin, CI). - **Less noise** — Feedback CTA shows every 5th scan instead of every scan. - **Trust badges** — Generate trust badges for skill READMEs with `npx clawvet badge`. - **Ban lists** — Block skills by name/author/slug via `.clawvetban` files. - **Confidence scores** — Each finding shows a confidence percentage. Risk scores are weighted accordingly. - **Fix suggestions** — Every finding includes an actionable remediation in terminal and SARIF output. - **Content-hash caching** — Repeat scans of unchanged files are near-instant. - **Feedback form** — Run `npx clawvet feedback` to share what you think. ## Risk Grades | Score | Grade | Action | |-------|-------|--------| | 0-10 | A | Safe to install | | 11-25 | B | Safe to install | | 26-50 | C | Review before installing | | 51-75 | D | Review carefully | | 76-100 | F | Do not install |


Security scan verdicts — ClawScan: suspicious | static analysis: suspicious | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: wanng-ide/markdown-linter (version 1.0.0)

--- name: markdown-linter description: Validates Markdown files in the workspace for broken local links, missing file references, and basic syntax issues. Use to maintain documentation integrity and prevent broken references in MEMORY.md or SKILL.md files. --- # Markdown Linter A lightweight tool to validate Markdown files in the workspace. It focuses on ensuring internal consistency, particularly broken file links and missing references. ## Capabilities - **Link Validation**: Checks `[link](path)` references to ensure the target file exists locally. - **Header Check**: Verifies that headers follow a logical hierarchy (e.g., H1 -> H2). - **Code Block Check**: Ensures code blocks have language identifiers where appropriate. ## Usage ```javascript const linter = require('./index'); const results = await linter.scan('.'); // Scans current directory recursively console.log(JSON.stringify(results, null, 2)); ``` ## Output Format ```json { "totalFiles": 15, "brokenLinks": [ { "file": "docs/README.md", "line": 10, "link": "./missing-image.png", "error": "File not found" } ], "syntaxErrors": [] } ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: 52yuanchangxing/content-repurpose-studio (version 1.0.0)

--- name: content-repurpose-studio description: Transform one source asset into a coordinated pack for multiple channels such as WeChat, Xiaohongshu, TikTok, email, and slides. version: 1.1.0 metadata: openclaw: requires: bins: - python3 emoji: 🧰 --- # Content Repurpose Studio ## Purpose Transform one source asset into a coordinated pack for multiple channels such as WeChat, Xiaohongshu, TikTok, email, and slides. ## Trigger phrases - 一稿多发 - repurpose this content - 内容分发改写 - multi-channel content pack - 同一内容改成多平台 ## Ask for these inputs - source article/video/transcript - target channels - brand voice - CTA - length constraints ## Workflow 1. Identify the core message, proof, and CTA from the source. 2. Map channel-specific constraints using the bundled channel specs. 3. Produce platform-native variants instead of shallow copies. 4. Keep a shared facts block so claims remain consistent across channels. 5. Return a launch checklist with filenames and publishing order. ## Output contract - channel pack - shared facts block - launch checklist - reuse matrix ## Files in this skill - Script: `{baseDir}/scripts/channel_packager.py` - Resource: `{baseDir}/resources/channel_specs.yaml` ## Operating rules - Be concrete and action-oriented. - Prefer preview / draft / simulation mode before destructive changes. - If information is missing, ask only for the minimum needed to proceed. - Never fabricate metrics, legal certainty, receipts, credentials, or evidence. - Keep assumptions explicit. ## Suggested prompts - 一稿多发 - repurpose this content - 内容分发改写 ## Use of script and resources Use the bundled script when it helps the user produce a structured file, manifest, CSV, or first-pass draft. Use the resource file as the default schema, checklist, or preset when the user does not provide one. ## Boundaries - This skill supports planning, structuring, and first-pass artifacts. - It should not claim that files were modified, messages were sent, or legal/financial decisions were finalized unless the user actually performed those actions. ## Compatibility notes - Directory-based AgentSkills/OpenClaw skill. - Runtime dependency declared through `metadata.openclaw.requires`. - Helper script is local and auditable: `scripts/channel_packager.py`. - Bundled resource is local and referenced by the instructions: `resources/channel_specs.yaml`.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: n4cra/legiscan-bill-search (version 1.0.0)

# LegiScan Bill Tracker A skill to monitor state legislative activity using the LegiScan API. It filters for active bills based on custom keywords and state selection. ## Setup 1. **API Key**: Obtain a free API key from [LegiScan](https://legiscan.com/legiscan). 2. **Environment Variable**: Set `LEGISCAN_API_KEY` in your environment. 3. **Dependencies**: Requires `requests`. ## Usage Run the script directly or via a scheduled task (cron). ```bash # Default (TX, cryptocurrency keywords) python3 search.py # Custom State and Keywords python3 search.py --state TX --keywords "crypto, bitcoin, blockchain" # Include passed/completed bills python3 search.py --state TX --keywords "crypto, bitcoin, blockchain" --all ``` ## Configuration Options - `--state`: Two-letter state abbreviation (Default: `TX` or `LEGISCAN_STATE` env var). - `--keywords`: Comma-separated list of terms to search for. - `--all`: If flag is present, includes bills that have passed or are completed. ## Best Practices - The script uses environment variables for sensitive credentials. - It provides CLI arguments for flexibility without modifying code. - It includes error handling for API failures and missing configuration.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: tobeyrebecca/toby-generate-orthopedic-physical-therapy-practice-client-education-handout (version 1.0.0)

--- name: Generate Orthopedic Physical Therapy Practice Client Education Handout description: "Create a polished explainer handout with visuals, FAQs, and clear next steps for a physical therapy practice. Use when handling client education work..." version: "1.0.0" allowed-tools: Bash, Read metadata: openclaw: emoji: "📝" homepage: "https://www.skillboss.co/skills/generate-orthopedic-physical-therapy-practice-client-education-handout" --- > 📖 **Complete setup guide**: https://skillboss.co/skill.md # Generate Orthopedic Physical Therapy Practice Client Education Handout Create a polished explainer handout with visuals, FAQs, and clear next steps for a physical therapy practice. Use when handling client education work... ## Use When Use this skill for client education work for physical therapists, rehab clinic operators. ## Workflow 1. Clarify the audience, business goal, constraints, and deliverable. 2. Produce the strongest first draft for the target use case. 3. Use the relevant SkillBoss capabilities to enrich assets or supporting data. 4. Refine the output for accuracy, readability, and actionability before delivery. ## SEO / GEO - Primary keywords: physical therapy practice education handout, physical therapy practice client explainer, physical therapy practice FAQ guide, physical therapy practice visual handout - Search intent: client education - Canonical slug: `generate-orthopedic-physical-therapy-practice-client-education-handout` - Install query: Install Generate Orthopedic Physical Therapy Practice Client Education Handout with SkillBoss ## APIs Used - `chat` - `image_generation` ## Suggested Prompt [Generate Orthopedic Physical Therapy Practice Client Education Handout] for my physical therapy practice ## Notes - Create a polished explainer handout with visuals, FAQs, and clear next steps for a physical therapy practice - Use human review before sending patient-facing content or relying on regulated medical claims. ## SEO Keywords - physical therapy practice education handout - physical therapy practice client explainer - physical therapy practice FAQ guide - physical therapy practice visual handout


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: julianengel/domaindetails (version 1.2.0)

--- name: domaindetails description: Look up domain WHOIS/RDAP info and check marketplace listings. Free API, no auth required. metadata: {"clawdbot":{"emoji":"🌐","requires":{"bins":["curl"]}}} --- # domaindetails Domain lookup and marketplace search. Free API, just curl. ## Domain Lookup ```bash curl -s "https://mcp.domaindetails.com/lookup/example.com" | jq ``` Returns: registrar, created/expires dates, nameservers, DNSSEC, contacts. ## Marketplace Search ```bash curl -s "https://api.domaindetails.com/api/marketplace/search?domain=example.com" | jq ``` Returns listings from: Sedo, Afternic, Atom, Dynadot, Namecheap, NameSilo, Unstoppable Domains. ## Rate Limits - 100 requests/minute (no auth needed) ## CLI (Optional) ```bash npx domaindetails example.com ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: harrey401/lofy-projects (version 1.0.0)

--- name: lofy-projects description: Project management for the Lofy AI assistant — tracks multiple projects with milestones, priority scoring engine (urgency × job relevance × momentum × energy match), meeting prep automation, time logging, stale project alerts, and work session recommendations. Use when managing projects, prioritizing work, preparing for meetings, or tracking milestones and deadlines. --- # Project Pilot — Project & Academic Manager Keeps projects, coursework, and research organized. Tracks status, deadlines, blockers, and helps prioritize work time. ## Data File: `data/projects.json` ```json { "projects": { "example_project": { "name": "Example Project", "status": "active", "phase": "Phase 1", "description": "", "stack": [], "milestones": [ { "name": "Milestone 1", "status": "in_progress", "target_date": null } ], "blockers": [], "next_actions": [], "time_log": [], "last_updated": null, "job_relevance": "high" } }, "academic": { "graduation": null, "deadlines": [], "meetings": [] } } ``` ## Priority Engine When user asks "what should I work on?": ``` Priority = (Urgency × 3) + (Job_Relevance × 2) + (Momentum × 1) + (Energy_Match × 1) Urgency (0-5): 5=due today, 4=48h, 3=this week, 2=this month, 1=no deadline, 0=backlog Job_Relevance (0-5): 5=critical, 4=high, 3=medium, 2=portfolio, 1=low, 0=none Momentum (0-3): 3=active progress, 2=touched last 3 days, 1=stale 1-2 weeks, 0=cold 2+ weeks Energy_Match (0-2): 2=matches current energy, 1=neutral, 0=mismatch ``` ### Time-Based Recommendations - **< 30 min:** Quick tasks — email, review, read, update docs - **30-60 min:** Medium — write one function, prep notes, apply to 1 job - **1-2 hours:** Focused — implement a feature, write paper section, debug - **2+ hours:** Deep work — major development sessions ## Meeting Prep When a meeting is detected: 1. Identify related project 2. Pull recent time_log entries since last meeting 3. List current blockers 4. Generate 2-3 questions to ask 5. Suggest what to demo/present 6. Send prep 2 hours before ## Status Updates via Natural Language - "Worked on [project] for 2 hours" → update time_log, last_updated - "[Feature] is working now" → update milestone status - "Stuck on [issue]" → add to blockers - "Meeting moved to Thursday" → update meetings ## Instructions 1. Always read `data/projects.json` before responding about projects 2. Update JSON after any project conversation 3. For "what should I work on?" — ONE clear recommendation + one alternative 4. Flag stale projects: "[Project] hasn't been touched in X days" 5. Before meetings, proactively send prep 6. Prioritize job-critical projects unless there's a deadline override


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: xuanyushen19/mt5trade (version 1.0.0)

--- name: mt5-http-trader description: Call local MT5 trading HTTP API (signal → draft → confirm) with safety confirmation metadata: { "openclaw": { "os": \["win32"], "emoji": "📈" } } --- You are an execution-focused trading assistant. You MUST follow the safety rules below. \## Base URL All requests go to: http://127.0.0.1:8000 \## Tools Use the Exec Tool to run PowerShell. Prefer Invoke-RestMethod (irm) for JSON. \## Safety rules (MANDATORY) 1\) Never call /order\_confirm automatically. 2\) Before /order\_confirm, always: - call /order\_draft and show the full draft JSON to the user, - ask the user to reply EXACTLY: CONFIRM ORDER 3\) Only if the user replies exactly "CONFIRM ORDER", then call /order\_confirm with the draft payload (or confirm payload required by API). 4\) If healthcheck fails, stop. \## Healthcheck Run: powershell -NoProfile -Command "irm http://127.0.0.1:8000/health | ConvertTo-Json -Depth 50" Expect: ok=true (or equivalent). If not, stop and report error. \## Get pair signal Endpoint: POST http://127.0.0.1:8000/pair\_signal Body example: { "a\_symbol":"AEP", "b\_symbol":"LNT", "timeframe":"M30" } Run: powershell -NoProfile -Command "$body=@{a\_symbol='AEP';b\_symbol='LNT';timeframe='M30'} | ConvertTo-Json; irm -Method Post -Uri http://127.0.0.1:8000/pair\_signal -ContentType 'application/json' -Body $body | ConvertTo-Json -Depth 50" Interpret the response and decide whether to proceed to draft. If the signal says NO TRADE / HOLD, stop and summarize. \## Draft order (prepare only) Endpoint: POST http://127.0.0.1:8000/order\_draft Input should include what your API needs. If unsure, pass through the pair\_signal result plus user risk constraints. Always display the full draft JSON to the user. \## Confirm order (REQUIRES USER CONFIRMATION) Endpoint: POST http://127.0.0.1:8000/order\_confirm Only call this after user replies EXACTLY: CONFIRM ORDER. Then run: powershell -NoProfile -Command "$body = '<PASTE\_DRAFT\_JSON\_HERE>'; irm -Method Post -Uri http://127.0.0.1:8000/order\_confirm -ContentType 'application/json' -Body $body | ConvertTo-Json -Depth 50" After confirming, display the broker/order response clearly.


Security scan verdicts — ClawScan: suspicious | static analysis:  | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: guohongbin-git/crypto-arb-cn (version 1.0.1)

--- name: crypto-arb-cn description: "加密货币套利监控 | Cryptocurrency Arbitrage Monitor. 支持币安、OKX、Gate.io、火币 | Supports Binance, OKX, Gate.io, Huobi. 实时价格监控、利润计算、Telegram通知 | Real-time price monitoring, profit calculation, Telegram alerts. 触发词：套利、arbitrage、加密货币、crypto、价格差. Find arbitrage opportunities across Chinese-accessible exchanges." --- # Crypto Arbitrage CN Monitor cryptocurrency prices across Chinese-accessible exchanges and find arbitrage opportunities. ## Quick Start ```bash # Single check for opportunities python scripts/arbitrage_monitor.py --once # Continuous monitoring (every 30 seconds) python scripts/arbitrage_monitor.py ``` ## Supported Exchanges | Exchange | Fee | API | |----------|-----|-----| | Binance | 0.1% | ✅ | | OKX | 0.08% | ✅ | | Gate.io | 0.2% | ✅ | | Huobi | 0.2% | ✅ | ## Configuration Edit these variables in `scripts/arbitrage_monitor.py`: ```python # Trading pairs to monitor SYMBOLS = ["BTCUSDT", "ETHUSDT", "SOLUSDT", "DOGEUSDT"] # Minimum profit threshold (after fees) MIN_PROFIT_PERCENT = 0.5 # 0.5% # Check interval (for continuous mode) INTERVAL = 30 # seconds ``` ## Output Format When opportunities are found: ``` 💰 BTCUSDT | 币安 → OKX | 利润: 0.65% 买入: ¥485,230 (币安) 卖出: ¥488,380 (OKX) 预计利润: ¥3,150 (每 BTC) ``` ## Usage Examples **Check once:** ``` 用户: 帮我看看现在有没有套利机会 → Run: python scripts/arbitrage_monitor.py --once ``` **Start monitoring:** ``` 用户: 开始监控套利机会 → Run: python scripts/arbitrage_monitor.py ``` **Add Telegram notification:** ``` 用户: 有机会发 Telegram 给我 → Set up TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID ``` ## Important Notes 1. **Fees matter**: Always calculate profit after trading fees (0.1-0.2% per trade) 2. **Transfer time**: Cross-exchange arbitrage requires crypto transfer (10-60 min) 3. **Price volatility**: Prices change fast, opportunities may disappear 4. **Risk warning**: Arbitrage involves risk, user discretion advised ## References - See [references/exchanges.md](references/exchanges.md) for detailed exchange API documentation


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)