Dfw Trading Signals

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears purpose-aligned for crypto market analysis, using public data APIs and a CoinGecko key, but users should treat its trading guidance and unpinned dependencies with caution.

Before installing, use a limited CoinGecko API key, be aware that uv will install unpinned Python dependencies, and treat the trading signals as informational rather than guaranteed financial advice. The provided artifacts do not show the skill placing trades or modifying accounts.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Your CoinGecko key and quota may be used when the skill fetches market data.

Why it was flagged

The skill uses a user-provided CoinGecko API key in CoinGecko request headers. This is expected for its market-data purpose, and the artifacts do not show hardcoding, logging, or sending the key to unrelated services.

Skill content

api_key = os.environ.get("COINGECKO_API_KEY", "") ... headers["x-cg-demo-api-key"] = api_key

Recommendation

Use a limited CoinGecko key intended for market-data access, and rotate it if you no longer use the skill.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installation depends on external package repositories and the latest compatible package versions.

Why it was flagged

The install specification pulls third-party Python packages without pinned versions. This is a normal setup pattern for API integrations, but package contents can change over time.

Skill content

uv | package: requests; uv | package: ccxt

Recommendation

Install from a trusted environment, consider pinning dependency versions, and review dependency provenance if using this for important decisions.

Low

#ASI09: Human-Agent Trust Exploitation

What this means

A user could treat the output as trading advice and make financial decisions based on it.

Why it was flagged

The skill presents confidence and position-sizing guidance for trading decisions. This is aligned with the skill’s stated purpose, but it could lead users to over-trust model-generated financial recommendations.

Skill content

Threshold guidance: - ≥80% confidence: High conviction, normal position size ... 50–64%: Low conviction, paper trade or skip

Recommendation

Use the signals as one input only, verify with independent analysis, and avoid letting an agent act on the guidance without explicit human review.