Crypto Sniping
ReviewAudited by ClawScan on May 10, 2026.
Overview
This is a real Binance auto-trading bot that can use API keys to place live trades, and its paper-mode and risk-limit behavior is not fully aligned with its documentation.
Only use this skill if you are comfortable reviewing and operating an automated crypto trading bot. Start with restricted Binance keys, no withdrawal permission, and preferably no live-trading permission until you have tested the code. Verify where daily loss and trade limits are actually read, confirm paper mode does not touch live account data if that matters to you, and be aware that Telegram notifications can share trading activity outside your machine.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
In live mode, the bot may place Binance trades without per-trade confirmation, and a user who changes the documented daily limits may not actually constrain the bot as expected.
The bot can automatically execute trades in its loop, while the documented config places max_daily_trades and max_daily_loss under the trading section, not the risk section the code reads.
max_daily_trades=self.config['risk'].get('max_daily_trades', 5),
max_daily_loss=self.config['risk'].get('max_daily_loss', 500),
...
if signal.confidence >= 4:
trade = self.trader.execute_signal(signal)Use paper mode until behavior is verified, put limits where the code actually reads them or fix the code/docs mismatch, and require an explicit live-mode confirmation or kill switch before enabling real trading.
Even simulated trading can require and use real Binance API credentials and account balance data.
A real Binance account balance is read before the paper/live branch, so paper trading still depends on signed account access rather than being fully isolated from live credentials.
account = self.client.get_account()
usdt_balance = float([b for b in account["balances"] if b["asset"] == "USDT"][0]["free"])
...
if self.paper_mode:
order_id = self._paper_trade(symbol, side, position_size, signal.price)Use restricted keys with no withdrawal permission, prefer read-only keys for paper/testing where possible, and modify the paper mode to use a configured virtual balance instead of signed account access.
A user may trust paper mode as fully virtual even though the bot still touches live exchange account data.
The documentation says paper mode uses a virtual balance, but the code shown reads the live Binance account balance before simulating a paper trade.
**"Insufficient balance"** - Check USDT balance in Spot wallet - Paper mode uses virtual balance
Clarify the documentation and implementation so paper mode is credential-free or explicitly state that it reads live account balances.
Trading activity and bot errors may be shared with a Telegram chat or bot service.
If Telegram credentials are configured, trade, signal, whale-alert, and error messages are sent to Telegram.
url = f"https://api.telegram.org/bot{self.telegram_token}/sendMessage"
payload = {
"chat_id": self.telegram_chat_id,
"text": message,
"parse_mode": "Markdown"
}Only enable Telegram notifications for trusted chats, protect the bot token, and avoid sending sensitive account details in messages.
It is harder to verify who maintains the trading bot or whether this is the intended source.
The skill lacks clear provenance, which is especially important because it handles financial exchange credentials and trading actions.
Source: unknown Homepage: none
Review the source carefully, lock dependency versions, and avoid granting live trading credentials until provenance and behavior are verified.