Beetrade
v0.1.4Use Beecli to interact with the Beetrade platform for authentication, market data, bot/strategy operations, alerts, accounts, and portfolio workflows. Use th...
⭐ 0· 481·0 current·0 all-time
byBeeTrade@htranbee
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the behavior: the skill is an instruction-only wrapper around the 'beecli' CLI and the install spec installs an npm package that provides that binary. Required binaries and the CLI-focused workflow are appropriate for a CLI skill.
Instruction Scope
SKILL.md confines actions to running beecli, checking auth, listing resources, and requiring confirmation for mutating operations; it also imposes strong redaction and 'never read ~/.beecli/config.json' rules. One minor inconsistency: SKILL.md claims the API URL is fixed and not configurable, yet references/commands.md documents an apiUrl field in ~/.beecli/config.json, implying configurability. The workflow otherwise stays within CLI scope and does not instruct the agent to access unrelated files or credentials directly.
Install Mechanism
Install uses an npm package (@beelabs/beetrade-cli) that creates the 'beecli' binary — this is proportionate for installing a CLI. npm installs execute code from the registry, so there's inherent moderate risk in installing third-party packages; however the install mechanism itself is expected for a CLI skill.
Credentials
The skill requests no environment variables and relies on the CLI and its config file for credentials. That aligns with a typical CLI-based integration. The SKILL.md explicitly forbids the agent from reading config files or exposing tokens, which is consistent with not requesting additional credentials in requires.env.
Persistence & Privilege
The skill does not request always:true and does not ask to modify other skills or system-wide settings. It installs a binary (normal for a CLI) but does not request elevated persistent privileges in the bundle metadata.
Assessment
This skill looks coherent for operating the Beetrade CLI, but before installing: 1) Verify the npm package @beelabs/beetrade-cli and its publisher (check the package page, repository, and recent releases) because npm packages run code during install. 2) Note the small documentation mismatch: SKILL.md says the API URL is fixed, but the reference shows an apiUrl in the local config — confirm whether the CLI actually allows overriding the API endpoint. 3) Expect the CLI to create/consume credentials in ~/.beecli/config.json even though the skill forbids directly reading that file; the agent will run the CLI which itself will read/write that file. 4) If you plan to use live trading, require explicit confirmations and consider testing in a sandbox/paper environment first. 5) If you need higher assurance, inspect the npm package source or run the CLI in an isolated environment before granting it access to your real accounts.Like a lobster shell, security has layers — review code before you run it.
latestvk973vz2r8fmn09q2arth0t12as823tbd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsbeecli
Install
Install Beetrade CLI (npm)
Bins: beecli
npm i -g @beelabs/beetrade-cli