Paper Trader

PassAudited by ClawScan on May 10, 2026.

Overview

Paper Trader appears to be a local simulated-trading journal that stores data in a SQLite file; the only command-execution signal is test code running its own CLI.

This skill looks appropriate for local paper-trading records. Before using it, be comfortable with it creating and updating a SQLite database under .openclaw or a path you choose with --db, and remember that notes and strategy details may persist on disk. Because the provided primary script content was truncated in this scan context, review the full script if available before relying on it for important records.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the test suite will execute the local CLI commands used by the skill, but the provided tests target temporary databases rather than user trading data.

Why it was flagged

The test suite spawns Node to run the skill's CLI. The executable and script path are fixed by the test harness, and the databases are temporary, so this appears to be expected validation behavior.

Skill content
const res = spawnSync(
    process.execPath,
    ['--experimental-strip-types', scriptPath, '--db', dbPath, ...args],
Recommendation

Run tests only from a trusted copy of the skill, and review the script before executing validation commands if you are cautious.

What this means

Your simulated trades, PnL history, and notes may remain on disk and be readable by anyone or any process with access to that file.

Why it was flagged

The skill persistently stores paper-trading events and journal notes in a local SQLite database. This is aligned with the stated purpose, but it may contain private strategy or financial-planning information.

Skill content
Default DB path:

```bash
~/.openclaw/paper-trading.db
```

... Events are append-only in SQLite (`events` table).
Recommendation

Use the default database only if local persistence is acceptable, or choose a protected location with '--db <path>' and delete or back up the database as needed.