技能 blackforge

📦

blackforge

Name: blackforge
Author: blackforge-so

內容修訂 r1 中風險 🌐 網路存取📁 檔案系統存取🔑 環境變數⚙️ 外部命令

Explore Crypto Market Data with BlackForge

Crypto market questions require precise metric definitions, exchange identifiers, and reliable time windows. BlackForge connects those questions to its MCP tools or CLI and explains returned measurements with units and quality context.

支援: Claude Codex Code(CC)

📊 74 尚可

Maintain this Skill? Claim it 📊 74 尚可

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "blackforge" from https://skillstore.io/skills/blackforge-so-blackforge.md and its manifest at https://skillstore.io/api/skills/blackforge-so-blackforge/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/blackforge-so-blackforge.md 已簽名 manifest GET /api/skills/blackforge-so-blackforge/manifest 已簽名 lockfile GET /api/skills/blackforge-so-blackforge/lockfile

測試它

正在使用「blackforge」。 Explain ETHUSDT bid depth within 5% on Binance.

預期結果:

Example interpretation: this value measures resting buy liquidity from the best bid down to 5% below it, in USDT. The result includes the completed bucket time and relevant quality flags.

正在使用「blackforge」。 Show the BTC-USDT spread on OKX over the last week.

預期結果:

Example interpretation: spread equals best ask minus best bid at matching timestamps. The comparison states the UTC range, selected interval, and any missing points or quality concerns.

正在使用「blackforge」。 Why is my historical series shorter than requested?

預期結果:

Example explanation: your plan may limit how far back the key can read. Compare the first returned timestamp with the requested start before concluding that older data is unavailable.

安全審計

中風險

v1 • 2026/10/12 開啟版本化報告

The static alerts reflect documentation syntax, market vocabulary, public catalog access, and intended authentication rather than demonstrated malicious behavior. Two semantic risks remain: automatic execution of unpinned npm clients and credential exposure through documented command arguments. No evidence found of prompt injection, deliberate credential theft, or unrelated sensitive-file access in the reviewed sources.

已掃描檔案

1,078

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (2)

中

scripts/latest-json.sh:23-33 .claude-plugin/plugin.json:21-25 SKILL.md:184-186 references/setup.md:44-57

Automatic Execution of Unpinned External Clients

The wrapper falls back to "npx -y @blackforge-so/cli", and the plugin launches an unpinned MCP package. A compromised release could execute with user privileges and access available credentials. No evidence found that these packages are malicious; their implementations are outside this source review.

The fallback directly executes an unversioned package with automatic confirmation. The plugin uses the same mechanism, establishing supply-chain exposure without proving malicious intent.

中

references/setup.md:63-67 references/setup.md:95-102

Credential Exposure Through Setup Command Arguments

The setup commands place "BLACKFORGE_API_KEY=bf_your_key_here" and "blackforge auth set-key bf_your_key_here" directly in arguments. Replacing these placeholders with real keys can expose credentials through shell history and process inspection.

The documented workflow requires substituting real credentials into command arguments. Exposure depends on local history and process visibility; the repository itself contains only placeholders.

風險因素

🌐 網路存取 (6)

.claude-plugin/plugin.json:8 .claude-plugin/plugin.json:10 .claude-plugin/plugin.json:11 scripts/check-catalog-sync.mjs:57 scripts/check-catalog-sync.mjs:37 SKILL.md:57

📁 檔案系統存取 (7)

references/setup.md:99 references/setup.md:99 scripts/check-catalog-sync.mjs:39 scripts/check-catalog-sync.mjs:44 scripts/latest-json.sh:16 scripts/latest-json.sh:16 scripts/latest-json.sh:24

🔑 環境變數 (8)

references/setup.md:46 references/setup.md:57 references/setup.md:66 references/setup.md:102 scripts/check-catalog-sync.mjs:37 scripts/check-catalog-sync.mjs:37 scripts/latest-json.sh:15 scripts/latest-json.sh:16

⚙️ 外部命令 (50)

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/blackforge-so-blackforge/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/blackforge-so-blackforge/security.svg)](https://skillstore.io/skills/blackforge-so-blackforge?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/blackforge-so-blackforge?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/blackforge-so-blackforge/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/blackforge-so-blackforge.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

blackforge-so. (2026). blackforge security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/blackforge-so-blackforge/audits/1

BibTeX 引用

@techreport{blackforge-so-blackforge-so-blackforge-2026,
  author = {blackforge-so},
  title = {blackforge security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/blackforge-so-blackforge/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "blackforge security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "blackforge-so"
date-released: "2026-10-12"
url: "https://skillstore.io/skills/blackforge-so-blackforge/audits/1"
identifiers:
  - type: other
    value: "skillstore:blackforge-so-blackforge:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Review Spot Market Liquidity

Inspect resting liquidity and taker volume for a specified pair, with clear units, snapshot timing, and data quality caveats.

Compare Historical Measurements

Retrieve aligned time series and compare measured spreads or trade flow across periods without treating observations as forecasts.

Check Data Access and Consumption

Confirm available pairs, account usage, and plan restrictions before integrating BlackForge measurements into a reporting workflow.

試試這些提示

Find Available Pairs

Use BlackForge to list Kraken pairs quoted in USDT. Confirm exchange and symbol identifiers before presenting the results.

Read a Latest Snapshot

Show the latest ETHUSDT bid depth within 5% on Binance. Include units, quality flags, and the actual completed bucket length.

Compare Taker Trade Flow

Compare SOLUSDT taker buy and sell volume on Binance over the last 24 hours. State the UTC range, supported interval, and quality caveats.

Derive a Historical Spread

Derive BTC-USDT bid-ask spreads on OKX for the last seven days from best bid and ask series. Align timestamps and report plan restrictions.

最佳實務

Confirm metric keys and native exchange symbols through the catalog and pair list before querying.
Include quality flags, units, UTC timestamps, and the actual plan-supported interval when reporting measurements.
Use reviewed, version-pinned clients and keep API credentials outside command arguments, shared configuration, and version control.

避免

Treating resting liquidity, trade flow, or historical spreads as buy or sell recommendations.
Guessing metric keys, confusing percent depth bands with basis points, or requesting non-queryable identity fields.
Interpreting omitted columns or silently shortened history as proof that the underlying data does not exist.

常見問題

What must I configure before querying data?

Configure the BlackForge MCP server or CLI and provide an API key for authenticated queries. The public catalog does not require a key.

Does this skill recommend trades?

No. It explains measured market data and does not provide buy or sell recommendations or execute orders.

Which exchanges does the skill describe?

The documentation lists Binance, Bitget, Bybit, Coinbase, Gate, Kraken, KuCoin, MEXC, and OKX. Confirm current availability and plan access through the catalog.

How current is the latest snapshot?

It is the latest completed bucket at your plan's granularity: five minutes for Max or Ultra, one hour for Pro, and one day for Free.

Why can columns or historical points be missing?

Plans can omit restricted columns and silently shorten readable history. Compare returned timestamps with your requested range and inspect accounting headers when available.

Can the skill calculate a bid-ask spread?

Yes. There is no dedicated spread metric, so it subtracts best bid from best ask using matching time-series timestamps.

開發者詳細資訊

作者

blackforge-so

授權

MIT

Skillstore 修訂

版本提示

作者未聲明版本。

儲存庫

https://github.com/blackforge-so/skill/tree/b87e294feb12e6582cf98eb9782ff297f38fb028/

引用

ebcb2eb7ad397e055696549961e5b4f8cfeb7ea5

維護新鮮度

2026/10/13

使用量

0 次下載 · 0 次瀏覽

檔案結構

📁 .claude-plugin/

📄 plugin.json

📄 .gitignore

📁 evals/

📄 trigger-eval.json

📄 LICENSE

📄 README.md

📁 references/

📄 metrics-glossary.md

📄 setup.md

📁 scripts/

📄 check-catalog-sync.mjs

📄 latest-json.sh

📄 SKILL.md

查看全部

📦

bilig-workpaper

建置 WorkPaper 試算表自動化

由 proompteng

代理程式經常需要試算表邏輯，但不需要控制 Excel。此技能會引導 MCP 和 TypeScript 工作流程，用於 WorkPaper 公式、以檔案為後端的編輯，以及本機 XLSX 公式報告。

資料與分析查看

📦

outreachgenie-list-audit

Audit OutreachGenie Lists and Flow Templates

由 outreachgenie

Saved prospect lists can contain missing template values, incomplete captures, and text that exceeds product limits. This skill checks selected snapshots locally and produces private reports without modifying records or sending messages.

資料與分析查看

📦

gate-exchange-marketanalysis

分析 Gate Exchange 市場流動性

由 gate

加密貨幣市場結構在現貨與期貨資料之間可能難以比較。此 skill 會將請求路由至 Gate MCP 市場工具，並回傳結構化分析。

資料與分析查看

📦

azure-ai-anomalydetector-java

使用 Azure AI 建置 Java 異常偵測

由 sickn33

Java 團隊需要可靠的模式來偵測異常的時間序列行為。此技能提供 Azure AI Anomaly Detector 範例，涵蓋用戶端、模型、推論與錯誤處理。

資料與分析查看

📦

gate-dex-market

分析 Gate DEX 市場資料

由 gate

鏈上代幣研究需要快速且一致的公開市場資料。此技能會透過 MCP tools 擷取 Gate Wallet DEX 價格、流動性、排名與風險資訊。

資料與分析查看

📦

chilemai

Plan McDonald's Meals by Nutrition and Budget

由 hessianz

Choosing meals within nutrition and budget limits requires checking menus, serving sizes, and discounts. Chilemai combines current MCP data with local meal planning and confirmed ordering.

效率查看

blackforge

使用我的智慧代理安裝

Agent 可讀資源

測試它

安全審計

已確認的安全問題 (2)

風險因素

複製報告連結

Markdown 徽章

HTML 徽章

嵌入卡片

APA 引用

BibTeX 引用

CITATION.cff

Skillstore 評分

你可以打造什麼

Review Spot Market Liquidity

Compare Historical Measurements

Check Data Access and Consumption

試試這些提示

最佳實務

避免

常見問題

開發者詳細資訊

相關技能

bilig-workpaper

outreachgenie-list-audit

gate-exchange-marketanalysis

azure-ai-anomalydetector-java

gate-dex-market

chilemai