Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Portfolio Trader
v1.1.0Connect to a user's investment accounts via SnapTrade SDK and generate portfolio reports (e.g., daily total value). Use when the user wants SnapTrade-based b...
⭐ 0· 862·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (portfolio/trading via SnapTrade) matches the included scripts: account registration, connection portal, reconnect, list brokerages, list accounts, compute totals, per-broker totals with FX, place/watch orders. All requested actions (including trading) are justified by the stated purpose.
Instruction Scope
SKILL.md instructions stay within the SnapTrade domain: install SDK, create SnapTrade client credentials, store them in a local config file, run the provided scripts. The only external/actionable non-SnapTrade guidance is an instruction to use cron + WhatsApp to deliver reports (this is an implementation suggestion, not embedded exfiltration). The scripts do not read or send unrelated system data.
Install Mechanism
The skill is instruction-first with no aggressive installer. It lists snaptrade-python-sdk in requirements.txt (pip). Using pip to install a public SDK is expected for this functionality, but pip installs carry normal supply-chain risk — verify the package/version from PyPI or SnapTrade's recommended source before installing.
Credentials
The skill does not request environment variables; instead it requires a local JSON config file containing client_id and consumer_key (and the user_id/user_secret generated/stored by the scripts). This is proportionate to the stated purpose, but you must protect that file (SKILL.md recommends chmod 600).
Persistence & Privilege
always:false and the skill writes only its own config file under the workspace secrets path. However, the skill can place force orders via the SnapTrade trading API; since the skill is user-invocable and model-invocation is enabled by default, an agent with autonomous skill invocation could place trades unless you restrict it. This is expected given the trade capability but is an operational risk to consider.
Assessment
This skill appears to do what it claims: connect to SnapTrade, create/refresh connections, compute totals, and place/watch orders. Before installing: (1) Understand that you must supply SnapTrade client_id and consumer_key and protect the local config file (keep it chmod 600 and do not commit it). (2) Review and confirm the snaptrade-python-sdk package/version in requirements.txt comes from the official source before running pip install. (3) Be aware the scripts can place force orders — if you do not want automated trading, either avoid running the order scripts or disable autonomous model invocation for this skill / require explicit user approval before any order is placed. (4) Test with a read-only or sandbox SnapTrade account if possible to validate behavior without financial risk. (5) If you need stricter credential handling, consider putting credentials in a vault/secure env instead of the workspace file.Like a lobster shell, security has layers — review code before you run it.
latestvk977h6shv25zmkazre8z1edd2d814n63
License
MIT-0
Free to use, modify, and redistribute. No attribution required.