Kraken
v1.1.2Query Kraken crypto account balances, portfolio, trades, and staking positions.
⭐ 2· 2.1k·3 current·3 all-time
bySeth Rose@thesethrose
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to query Kraken account data and the code + SKILL.md legitimately use Kraken API clients and require KRAKEN_API_KEY / KRAKEN_API_SECRET. However, the skill registry metadata lists no required environment variables or primary credential, which is inconsistent with the stated purpose.
Instruction Scope
The runtime instructions and code are focused on calling Kraken's SDK (market, user, earn, funding endpoints) and reading a .env file in the skill directory. The SKILL.md instructs the user to export Kraken credentials or put them in .env; there are no instructions to read unrelated system files or exfiltrate data to other endpoints.
Install Mechanism
There is no install spec (low risk from downloads), but requirements.txt lists python-kraken-sdk and python-dotenv. Because dependencies are not declared in the registry/install step, the runtime may fail or an operator may need to install dependencies manually. No remote installers or obscure URLs are present in the provided files.
Credentials
The code and SKILL.md clearly expect KRAKEN_API_KEY and KRAKEN_API_SECRET (and will load a .env in the skill directory), but requires.env and primary credential are empty in the registry. That mismatch could lead users to provide credentials without the registry surface making that requirement explicit. The keys requested are proportional to the task, but the omission in metadata is a governance/visibility problem.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and only reads a .env from its own directory. It does not appear to persist credentials beyond reading environment variables/.env. Agent autonomous invocation remains enabled (the platform default), which is expected for skills but not itself a disqualifier.
What to consider before installing
Before installing or running this skill: 1) Be aware the code and README ask you to provide KRAKEN_API_KEY and KRAKEN_API_SECRET (via env vars or a .env file). The registry metadata does NOT list these — validate this mismatch with the publisher. 2) Prefer creating read-only / minimal-permission API keys (Query Funds / Earn read-only) rather than keys that allow trading or withdrawals. 3) Review the full source files locally (kraken_api.py, kraken_cli.py) for any hidden network calls or unexpected file I/O (the snippets appear focused on Kraken SDK calls, but review the truncated parts). 4) Install dependencies (python-kraken-sdk, python-dotenv) in an isolated environment (virtualenv) because there is no automatic installer. 5) Consider running the skill in a sandboxed environment and avoid reusing high-privilege API keys. 6) Because the skill source has no homepage and an unknown publisher, exercise extra caution — ask the publisher for provenance and request the registry be updated to explicitly declare required env vars and required permissions.Like a lobster shell, security has layers — review code before you run it.
balancevk9747ns874cnt902w7rzca17rn7yy698cryptovk9747ns874cnt902w7rzca17rn7yy698latestvk973e9tenwrq6zad39sahrwy7n7z9sp4tradingvk9747ns874cnt902w7rzca17rn7yy698
License
MIT-0
Free to use, modify, and redistribute. No attribution required.