ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

cTrader Commander

v1.0.0

Place and manage cTrader orders (market, limit, stop), check open positions, fetch live quotes and OHLC candles, and query account balance and equity via a l...

⭐ 2· 398·0 current·0 all-time
byElmo@elmoyeldo
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name and description match the runtime instructions: all API calls target a local cTrader proxy (http://localhost:9009) and are appropriate for placing orders, fetching quotes/candles, and querying account state.
ℹ
Instruction Scope
Instructions stay within the stated purpose (local REST calls to the proxy). However the SKILL.md tells users to clone/run the proxy repo and uses commands that assume tools not declared in metadata (python3 for timestamps, make/git to run the proxy). The skill also relies on credentials stored in the proxy's .env file (on the machine running the proxy) — callers never receive tokens, but the proxy will have them.
ℹ
Install Mechanism
The skill is instruction-only (no automatic install). That lowers direct risk, but the user is explicitly told to clone and run a third‑party GitHub repo (logicalSapien/ctrader-openapi-proxy). Running that code installs/executes external software on your machine; the repo appears to be the expected source, but you should audit or trust it before running.
ℹ
Credentials
The skill itself requests no environment variables, which is consistent with the model that credentials remain on the proxy. That said, the proxy requires a .env containing cTrader credentials (CTRADER_ACCOUNTID / access tokens) on the server — storing live trading credentials there is high‑privilege and should be treated carefully. Also the SKILL.md uses python3 though the declared required binaries list only curl.
✓
Persistence & Privilege
always:false and no install spec mean the skill does not demand permanent inclusion or special platform privileges. The primary risk is that the proxy you run will have persistent access to trading credentials and can execute trades on your account — which is expected for a trading proxy but should be managed.
Assessment
This skill is coherent: it issues curl calls to a local proxy which performs the real cTrader OpenAPI work. Before installing/using it: (1) Review and trust the GitHub proxy repo (LogicalSapien/ctrader-openapi-proxy) before cloning and running it; (2) run the proxy on a machine you control (or in an isolated/container environment) because the proxy's .env will contain trading credentials with power to place/cancel trades; (3) protect .env (file permissions, never expose the proxy to public network interfaces); (4) ensure required local tools are present (curl is declared, but the docs also use python3, git, and make); (5) consider restricting autonomous agent invocation if you do not want an agent to place trades without explicit confirmation. If you cannot review or trust the proxy code, do not run it with live credentials.

Like a lobster shell, security has layers — review code before you run it.

latestvk975p8xe3kdf39gqenx3t5bvyh81xnq8

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📈 Clawdis
Binscurl

Comments