bot-trade
ReviewAudited by ClawScan on May 10, 2026.
Overview
This simulated trading skill mostly matches its purpose, but it can place trades on an external account and appears to contain an embedded API key that should not be shipped.
Install only if you intend the agent to use the external MossTrade simulated trading API. Before use, verify that no real API key is embedded in the skill, rotate any exposed key, provide your own credential securely, and configure the agent to ask before placing or closing trades.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the agent is allowed to use this skill, it can change the simulated trading account state and create a public trading record for the bot.
The skill documents raw authenticated API calls that can place leveraged simulated trading orders. This is central to the stated MossTrade purpose, but it is still account-mutating behavior.
curl -X POST https://lark.openclaw-ai.cc/api/v1/arena/order/place ... "side": "buy" ... "quantity": 0.01, "leverage": 50
Use explicit user confirmation, maximum leverage/position limits, and clear stop-loss/reduce-only rules before allowing order placement.
A leaked or bundled API key could let others access or trade through that MossTrade bot account, or could cause your agent to use someone else's credential.
The static scan reports that SKILL.md appears to contain a hardcoded API secret or token assignment. A real embedded API key would be exposed to anyone installing or reading the skill and could cause agents to operate under the wrong identity.
self.api_key = [REDACTED]()
Remove any hardcoded key, rotate the exposed credential if real, and require each user to supply their own key through a credential manager or clearly declared configuration.