技能 blackforge
📦

blackforge

内容修订 r1 中风险 🌐 网络访问📁 文件系统访问🔑 环境变量⚙️ 外部命令

Explore Crypto Market Data with BlackForge

Crypto market questions require precise metric definitions, exchange identifiers, and reliable time windows. BlackForge connects those questions to its MCP tools or CLI and explains returned measurements with units and quality context.

支持: Claude Codex Code(CC)
📊 74 合格

使用我的智能体安装

将此请求复制给你的智能体,其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "blackforge" from https://skillstore.io/skills/blackforge-so-blackforge.md and its manifest at https://skillstore.io/api/skills/blackforge-so-blackforge/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划,并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文,而不是读取完整页面时,请使用这些链接。

测试它

正在使用“blackforge”。 Explain ETHUSDT bid depth within 5% on Binance.

预期结果:

Example interpretation: this value measures resting buy liquidity from the best bid down to 5% below it, in USDT. The result includes the completed bucket time and relevant quality flags.

正在使用“blackforge”。 Show the BTC-USDT spread on OKX over the last week.

预期结果:

Example interpretation: spread equals best ask minus best bid at matching timestamps. The comparison states the UTC range, selected interval, and any missing points or quality concerns.

正在使用“blackforge”。 Why is my historical series shorter than requested?

预期结果:

Example explanation: your plan may limit how far back the key can read. Compare the first returned timestamp with the requested start before concluding that older data is unavailable.

安全审计

中风险
v1 • 2026/10/12 打开版本化报告

The static alerts reflect documentation syntax, market vocabulary, public catalog access, and intended authentication rather than demonstrated malicious behavior. Two semantic risks remain: automatic execution of unpinned npm clients and credential exposure through documented command arguments. No evidence found of prompt injection, deliberate credential theft, or unrelated sensitive-file access in the reviewed sources.

10
已扫描文件
1,078
分析行数
0
复核项
0
已忽略误报

已确认安全问题 (2)

中
Automatic Execution of Unpinned External Clients
The wrapper falls back to "npx -y @blackforge-so/cli", and the plugin launches an unpinned MCP package. A compromised release could execute with user privileges and access available credentials. No evidence found that these packages are malicious; their implementations are outside this source review.
The fallback directly executes an unversioned package with automatic confirmation. The plugin uses the same mechanism, establishing supply-chain exposure without proving malicious intent.
中
Credential Exposure Through Setup Command Arguments
The setup commands place "BLACKFORGE_API_KEY=bf_your_key_here" and "blackforge auth set-key bf_your_key_here" directly in arguments. Replacing these placeholders with real keys can expose credentials through shell history and process inspection.
The documented workflow requires substituting real credentials into command arguments. Exposure depends on local history and process visibility; the repository itself contains only placeholders.

风险因素

🌐 网络访问 (6)
📁 文件系统访问 (7)
🔑 环境变量 (8)
⚙️ 外部命令 (50)
审计者: codex
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据,不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/blackforge-so-blackforge/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/blackforge-so-blackforge/security.svg)](https://skillstore.io/skills/blackforge-so-blackforge?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/blackforge-so-blackforge?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/blackforge-so-blackforge/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/blackforge-so-blackforge.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

blackforge-so. (2026). blackforge security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/blackforge-so-blackforge/audits/1

BibTeX 引用

@techreport{blackforge-so-blackforge-so-blackforge-2026, author = {blackforge-so}, title = {blackforge security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/blackforge-so-blackforge/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "blackforge security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "blackforge-so" date-released: "2026-10-12" url: "https://skillstore.io/skills/blackforge-so-blackforge/audits/1" identifiers: - type: other value: "skillstore:blackforge-so-blackforge:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
77
架构
85
可维护性
87
内容
65
社区
83
规范符合性

你能构建什么

Review Spot Market Liquidity

Inspect resting liquidity and taker volume for a specified pair, with clear units, snapshot timing, and data quality caveats.

Compare Historical Measurements

Retrieve aligned time series and compare measured spreads or trade flow across periods without treating observations as forecasts.

Check Data Access and Consumption

Confirm available pairs, account usage, and plan restrictions before integrating BlackForge measurements into a reporting workflow.

试试这些提示

Find Available Pairs
Use BlackForge to list Kraken pairs quoted in USDT. Confirm exchange and symbol identifiers before presenting the results.
Read a Latest Snapshot
Show the latest ETHUSDT bid depth within 5% on Binance. Include units, quality flags, and the actual completed bucket length.
Compare Taker Trade Flow
Compare SOLUSDT taker buy and sell volume on Binance over the last 24 hours. State the UTC range, supported interval, and quality caveats.
Derive a Historical Spread
Derive BTC-USDT bid-ask spreads on OKX for the last seven days from best bid and ask series. Align timestamps and report plan restrictions.

最佳实践

  • Confirm metric keys and native exchange symbols through the catalog and pair list before querying.
  • Include quality flags, units, UTC timestamps, and the actual plan-supported interval when reporting measurements.
  • Use reviewed, version-pinned clients and keep API credentials outside command arguments, shared configuration, and version control.

避免

  • Treating resting liquidity, trade flow, or historical spreads as buy or sell recommendations.
  • Guessing metric keys, confusing percent depth bands with basis points, or requesting non-queryable identity fields.
  • Interpreting omitted columns or silently shortened history as proof that the underlying data does not exist.

常见问题

What must I configure before querying data?
Configure the BlackForge MCP server or CLI and provide an API key for authenticated queries. The public catalog does not require a key.
Does this skill recommend trades?
No. It explains measured market data and does not provide buy or sell recommendations or execute orders.
Which exchanges does the skill describe?
The documentation lists Binance, Bitget, Bybit, Coinbase, Gate, Kraken, KuCoin, MEXC, and OKX. Confirm current availability and plan access through the catalog.
How current is the latest snapshot?
It is the latest completed bucket at your plan's granularity: five minutes for Max or Ultra, one hour for Pro, and one day for Free.
Why can columns or historical points be missing?
Plans can omit restricted columns and silently shorten readable history. Compare returned timestamps with your requested range and inspect accounting headers when available.
Can the skill calculate a bid-ask spread?
Yes. There is no dedicated spread metric, so it subtracts best bid from best ask using matching time-series timestamps.

开发者详情

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

引用

ebcb2eb7ad397e055696549961e5b4f8cfeb7ea5

维护新鲜度

2026/10/13

使用量

0 次下载 · 0 次浏览