OpenMM Portfolio

This skill appears to be the openmm CLI wrapper it claims to be, but there are a few red flags you should address before installing or providing secrets: - Metadata inconsistency: the registry lists all four exchange API_KEY variables as required, but the instructions say you only need to configure at least one exchange. Do not assume you must supply every key — verify whether keys are truly required and why metadata requires them. - Undeclared secrets: SKILL.md shows additional environment variables (SECRETS and BITGET_PASSPHRASE) that are not declared in metadata. Ask where and how these are used and stored, and whether they are optional. - Inspect the npm package: the skill installs @3rd-eye-labs/openmm to provide the binary. Before installing, check the package source on the npm registry or its repository to ensure it does not exfiltrate credentials, persist them insecurely, or perform unexpected network calls. - Use least-privilege keys: supply read-only API keys with limited permissions (no trading/withdraw) and consider using exchange sub-accounts or IP whitelisting while testing. - Ask for clarification: request the skill author to (a) correct required.env to include any required SECRETS/PASSPHRASE or state they are optional, (b) document exactly where credentials are stored and how they are protected, and (c) provide a link to the npm package source/repo for review. If you cannot validate these points, avoid providing live API secrets or install in a production environment.