Security audit
Security checks for vulnerabilities and agentic risk
The main REST workflow is read-only market-data access, but the skill also points agents to write-capable account tools while later describing the skill as read-only.
Install only if you are comfortable giving agents access to your Equibles API key. Prefer the documented REST examples for read-only market data; if you enable the MCP server, treat portfolio, watchlist, and feedback tools as account-changing actions and require explicit confirmation before any write, not only deletions.
The rules state that every request in the skill is a non-mutating HTTPS GET and that the skill writes nothing locally, but earlier text advertises an MCP server with write-capable tools. This contradiction can mislead reviewers or agents into treating the skill as read-only, lowering safeguards around actions that may modify user data.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Create a free account and an API key at https://equibles.com/dashboard/apikeys (free plan: 100 requests a day, no card). Keys start with `eq_`.
- Store it as `EQUIBLES_API_KEY` (for OpenClaw, `skills.entries.equibles.apiKey`). Send it only as `Authorization: Bearer $EQUIBLES_API_KEY`; never put it in a URL or print it.
- Base URL: `https://api.equibles.com/v1`. OpenAPI spec: https://api.equibles.com/openapi/v1.json. Reference: https://equibles.com/docs/api.
- A 401 with `"code": "unauthorized"` means the key is missing or wrong, not that the data is missing. A 429 means the daily allowance is used up; it resets at 00:00 UTC.
- Paged endpoints return `data` plus `meta` (`limit`, `offset`, `count`, `hasMore`). Errors share one shape: `{"error": {"code", "message", "status"}}`.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Create a free account and an API key at https://equibles.com/dashboard/apikeys (free plan: 100 requests a day, no card). Keys start with `eq_`.
- Store it as `EQUIBLES_API_KEY` (for OpenClaw, `skills.entries.equibles.apiKey`). Send it only as `Authorization: Bearer $EQUIBLES_API_KEY`; never put it in a URL or print it.
- Base URL: `https://api.equibles.com/v1`. OpenAPI spec: https://api.equibles.com/openapi/v1.json. Reference: https://equibles.com/docs/api.
- A 401 with `"code": "unauthorized"` means the key is missing or wrong, not that the data is missing. A 429 means the daily allowance is used up; it resets at 00:00 UTC.
- Paged endpoints return `data` plus `meta` (`limit`, `offset`, `count`, `hasMore`). Errors share one shape: `{"error": {"code", "message", "status"}}`.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Create a free account and an API key at https://equibles.com/dashboard/apikeys (free plan: 100 requests a day, no card). Keys start with `eq_`.
- Store it as `EQUIBLES_API_KEY` (for OpenClaw, `skills.entries.equibles.apiKey`). Send it only as `Authorization: Bearer $EQUIBLES_API_KEY`; never put it in a URL or print it.
- Base URL: `https://api.equibles.com/v1`. OpenAPI spec: https://api.equibles.com/openapi/v1.json. Reference: https://equibles.com/docs/api.
- A 401 with `"code": "unauthorized"` means the key is missing or wrong, not that the data is missing. A 429 means the daily allowance is used up; it resets at 00:00 UTC.
- Paged endpoints return `data` plus `meta` (`limit`, `offset`, `count`, `hasMore`). Errors share one shape: `{"error": {"code", "message", "status"}}`.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Create a free account and an API key at https://equibles.com/dashboard/apikeys (free plan: 100 requests a day, no card). Keys start with `eq_`.
- Store it as `EQUIBLES_API_KEY` (for OpenClaw, `skills.entries.equibles.apiKey`). Send it only as `Authorization: Bearer $EQUIBLES_API_KEY`; never put it in a URL or print it.
- Base URL: `https://api.equibles.com/v1`. OpenAPI spec: https://api.equibles.com/openapi/v1.json. Reference: https://equibles.com/docs/api.
- A 401 with `"code": "unauthorized"` means the key is missing or wrong, not that the data is missing. A 429 means the daily allowance is used up; it resets at 00:00 UTC.
- Paged endpoints return `data` plus `meta` (`limit`, `offset`, `count`, `hasMore`). Errors share one shape: `{"error": {"code", "message", "status"}}`.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Create a free account and an API key at https://equibles.com/dashboard/apikeys (free plan: 100 requests a day, no card). Keys start with `eq_`.
- Store it as `EQUIBLES_API_KEY` (for OpenClaw, `skills.entries.equibles.apiKey`). Send it only as `Authorization: Bearer $EQUIBLES_API_KEY`; never put it in a URL or print it.
- Base URL: `https://api.equibles.com/v1`. OpenAPI spec: https://api.equibles.com/openapi/v1.json. Reference: https://equibles.com/docs/api.
- A 401 with `"code": "unauthorized"` means the key is missing or wrong, not that the data is missing. A 429 means the daily allowance is used up; it resets at 00:00 UTC.
- Paged endpoints return `data` plus `meta` (`limit`, `offset`, `count`, `hasMore`). Errors share one shape: `{"error": {"code", "message", "status"}}`.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Create a free account and an API key at https://equibles.com/dashboard/apikeys (free plan: 100 requests a day, no card). Keys start with `eq_`.
- Store it as `EQUIBLES_API_KEY` (for OpenClaw, `skills.entries.equibles.apiKey`). Send it only as `Authorization: Bearer $EQUIBLES_API_KEY`; never put it in a URL or print it.
- Base URL: `https://api.equibles.com/v1`. OpenAPI spec: https://api.equibles.com/openapi/v1.json. Reference: https://equibles.com/docs/api.
- A 401 with `"code": "unauthorized"` means the key is missing or wrong, not that the data is missing. A 429 means the daily allowance is used up; it resets at 00:00 UTC.
- Paged endpoints return `data` plus `meta` (`limit`, `offset`, `count`, `hasMore`). Errors share one shape: `{"error": {"code", "message", "status"}}`.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Create a free account and an API key at https://equibles.com/dashboard/apikeys (free plan: 100 requests a day, no card). Keys start with `eq_`.
- Store it as `EQUIBLES_API_KEY` (for OpenClaw, `skills.entries.equibles.apiKey`). Send it only as `Authorization: Bearer $EQUIBLES_API_KEY`; never put it in a URL or print it.
- Base URL: `https://api.equibles.com/v1`. OpenAPI spec: https://api.equibles.com/openapi/v1.json. Reference: https://equibles.com/docs/api.
- A 401 with `"code": "unauthorized"` means the key is missing or wrong, not that the data is missing. A 429 means the daily allowance is used up; it resets at 00:00 UTC.
- Paged endpoints return `data` plus `meta` (`limit`, `offset`, `count`, `hasMore`). Errors share one shape: `{"error": {"code", "message", "status"}}`.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Create a free account and an API key at https://equibles.com/dashboard/apikeys (free plan: 100 requests a day, no card). Keys start with `eq_`.
- Store it as `EQUIBLES_API_KEY` (for OpenClaw, `skills.entries.equibles.apiKey`). Send it only as `Authorization: Bearer $EQUIBLES_API_KEY`; never put it in a URL or print it.
- Base URL: `https://api.equibles.com/v1`. OpenAPI spec: https://api.equibles.com/openapi/v1.json. Reference: https://equibles.com/docs/api.
- A 401 with `"code": "unauthorized"` means the key is missing or wrong, not that the data is missing. A 429 means the daily allowance is used up; it resets at 00:00 UTC.
- Paged endpoints return `data` plus `meta` (`limit`, `offset`, `count`, `hasMore`). Errors share one shape: `{"error": {"code", "message", "status"}}`.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Create a free account and an API key at https://equibles.com/dashboard/apikeys (free plan: 100 requests a day, no card). Keys start with `eq_`.
- Store it as `EQUIBLES_API_KEY` (for OpenClaw, `skills.entries.equibles.apiKey`). Send it only as `Authorization: Bearer $EQUIBLES_API_KEY`; never put it in a URL or print it.
- Base URL: `https://api.equibles.com/v1`. OpenAPI spec: https://api.equibles.com/openapi/v1.json. Reference: https://equibles.com/docs/api.
- A 401 with `"code": "unauthorized"` means the key is missing or wrong, not that the data is missing. A 429 means the daily allowance is used up; it resets at 00:00 UTC.
- Paged endpoints return `data` plus `meta` (`limit`, `offset`, `count`, `hasMore`). Errors share one shape: `{"error": {"code", "message", "status"}}`.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Create a free account and an API key at https://equibles.com/dashboard/apikeys (free plan: 100 requests a day, no card). Keys start with `eq_`.
- Store it as `EQUIBLES_API_KEY` (for OpenClaw, `skills.entries.equibles.apiKey`). Send it only as `Authorization: Bearer $EQUIBLES_API_KEY`; never put it in a URL or print it.
- Base URL: `https://api.equibles.com/v1`. OpenAPI spec: https://api.equibles.com/openapi/v1.json. Reference: https://equibles.com/docs/api.
- A 401 with `"code": "unauthorized"` means the key is missing or wrong, not that the data is missing. A 429 means the daily allowance is used up; it resets at 00:00 UTC.
- Paged endpoints return `data` plus `meta` (`limit`, `offset`, `count`, `hasMore`). Errors share one shape: `{"error": {"code", "message", "status"}}`.
The skill documentation introduces an MCP alternative with 10 write-capable tools for portfolios, watchlists, or feedback, even though the skill is otherwise framed as a read-only market-data integration. This expands the effective capability surface beyond the manifest's apparent purpose and could enable unintended state-changing actions if an agent/runtime follows the MCP path without strict user-consent gating.