Kraken Pro

Manage Kraken accounts via CLI to view portfolio, market data, place/cancel orders, manage staking, export ledger, and handle deposits/withdrawals.

Security Scan

The skill's code, instructions, and required credentials match its stated purpose (managing a Kraken account); nothing in the package appears to be doing unrelated actions, though it requires high-privilege API credentials and will install a PyPI package at runtime.

Purpose & Capability

Name/description, required binaries (python3), required env vars (KRAKEN_API_KEY, KRAKEN_API_SECRET), included code (kraken_cli.py) and requirements (python-kraken-sdk) all directly match a CLI for interacting with Kraken (portfolio, market data, trades, ledger, staking, deposits/withdrawals). There are no unrelated credentials or binaries requested.

Instruction Scope

SKILL.md instructs installing requirements and running the provided CLI. The runtime instructions and code only reference Kraken API calls, environment variables for keys, and local CSV/JSON outputs. There are no instructions to read unrelated files, access other system secrets, or send data to third-party endpoints outside of Kraken or PyPI (for package install).

Install Mechanism

There is no platform install spec; SKILL.md tells the user to run `pip3 install -r requirements.txt`, which will install python-kraken-sdk from PyPI (python-kraken-sdk==3.2.7 is pinned). This is expected for a Python CLI but is a moderate-risk install operation because it pulls code from a public registry. The packaged code itself is included (kraken_cli.py), so no arbitrary remote downloads beyond PyPI are required.

Credentials

The skill requires KRAKEN_API_KEY and KRAKEN_API_SECRET — these are exactly the credentials needed to perform authenticated account actions (orders, staking, withdrawals). That is proportionate to the claimed features, but these credentials are high-privilege (withdraw and create/modify orders). The SKILL.md and code rely on those credentials only and do not request unrelated secrets.

Persistence & Privilege

The skill does not request always:true or any special platform privileges. It doesn't modify other skills or system configuration. Note: model invocation is enabled by default (disable-model-invocation: false), so the agent could call this skill autonomously if the platform allows; combined with high-privilege API keys this increases risk in practice (see guidance).

Assessment

This package appears to do what it says: a CLI that uses the python-kraken-sdk to manage a Kraken account. Before installing and using it, consider the following: 1) Create API keys with the minimum required scopes — if you only need read access (portfolio, ledger, prices), create a read-only key and do NOT grant Withdraw/Create permissions. 2) If you need trading/withdrawal, be aware those scopes allow moving funds; only use them with trusted code. 3) The SKILL.md asks you to run `pip3 install -r requirements.txt` which will pull python-kraken-sdk from PyPI; review the dependency and prefer installing in an isolated virtualenv/container. 4) Although trading and withdrawals require explicit `--confirm` flags, an autonomous agent with access to the skill and stored API credentials could invoke commands; if you do not want autonomous use, restrict the agent's ability to call this skill or avoid storing secrets in agent config. 5) If you want maximum assurance, manually review the full kraken_cli.py content (the included file is present) and test with a least-privilege API key or a sandbox account before using with real funds.

Kraken Skill

Manage your Kraken exchange account via CLI.

Setup

pip3 install -r requirements.txt

Set credentials via environment variables or OpenClaw config (skills.entries.kraken-pro.env).

Get API key: https://www.kraken.com/u/security/api

Commands

Run: python3 kraken_cli.py <command> [options]

All commands accept --json for raw JSON output.

Portfolio (auth required)

Command	Description
summary	Portfolio overview (handles flex vs bonded earn correctly)
net-worth	Single net worth number
holdings	Asset breakdown with USD values
balance	Raw asset quantities

Market Data (no auth)

Command	Description
ticker --pair XBTUSD	Price and 24h stats
pairs	Trading pairs
assets	Asset list

Order History (auth required)

Command	Description
open-orders	Active orders
closed-orders [--limit N]	Completed orders
trades [--limit N] [--csv]	Trade execution history (CSV for export)

Ledger (auth required)

ledger [--start YYYY-MM-DD] [--end YYYY-MM-DD] [--asset BTC] [--type trade|deposit|withdrawal|staking] [--csv] [--limit N]

Auto-paginates (Kraken returns max 50/request). --csv dumps raw Kraken data.

Trading (auth required)

All trading commands require --confirm. Use --validate for dry-run.

Command	Description
buy --pair XBTUSD --type market|limit --amount N [--price P] --confirm	Place buy order
sell --pair XBTUSD --type market|limit --amount N [--price P] --confirm	Place sell order
cancel-order --id OXXXXX --confirm	Cancel specific order
cancel-all --confirm	Cancel all open orders

Always confirm with the user before placing real orders. Use --validate first.

Earn/Staking (auth required)

Command	Description
earn-positions	Current staking allocations
earn-strategies	Available yield programs
earn-status	Pending requests
earn-allocate --strategy-id ID --amount N --confirm	Stake funds
earn-deallocate --strategy-id ID --amount N --confirm	Unstake funds

Funding (auth required)

Command	Description
deposit-methods --asset BTC	Deposit methods for an asset
deposit-address --asset BTC	Get deposit address
withdraw --asset BTC --key NAME --amount N --confirm	Withdraw to saved address
withdraw-status	Recent withdrawal status

Withdrawal notes:

• Addresses must be pre-configured in Kraken's web UI (can't add via API)
• Can't list saved address names via API — ask the user for the key name
• Addresses are per-asset: a SOL address won't work for USDC withdrawals even if it's the same wallet. Each asset needs its own entry.
• --key is the saved address name in Kraken, not the actual address

Example Usage

User Request	Command
What's my portfolio?	summary
BTC price?	ticker --pair XBTUSD
Export 2025 ledger for taxes	ledger --start 2025-01-01 --end 2025-12-31 --csv
Export trade history	trades --csv
Buy 0.1 BTC at market	buy --pair XBTUSD --type market --amount 0.1 --confirm
Show staking positions	earn-positions

Kraken Pair Naming

Kraken uses non-standard names: XBT (not BTC), XETH (not ETH), Z-prefix for fiat (ZUSD, ZCAD). When unsure of a pair name, run pairs --json and grep for the asset.

Portfolio Logic

Kraken has two earn types:

• Auto Earn (flex): in main wallet, included in trade balance equity
• Bonded staking: separate earn wallet, NOT in trade balance

summary calculates: Total = Trade Balance Equity + Bonded Staking Only

API Permissions

Feature	Permission
Balances, portfolio, ledger	Query Funds
Orders, trades (view)	Query Open/Closed Orders & Trades
Place/cancel orders	Create & Modify Orders
Earn allocate/deallocate	Withdraw Funds
Withdrawals	Withdraw Funds
Market data	None