Crypto Portfolio Tracker

ReviewAudited by ClawScan on May 10, 2026.

Overview

This is a coherent instruction-only crypto portfolio tracker, but using it for live venues would involve sensitive exchange/account and trade-history data.

This skill appears benign from the supplied artifacts. Before using it with real accounts, grant only read-only or narrowly scoped credentials, verify any live-account actions such as auto-pause, and protect exported trade-history CSV files.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

If connected to real accounts, the agent may see sensitive balances, positions, and trading activity.

Why it was flagged

Live multi-venue portfolio tracking commonly requires access to exchange or market accounts. That access is consistent with the skill's purpose, but users should ensure any credentials are read-only or tightly scoped.

Skill content

- Binance Spot (paper + live via CCXT)
- Hyperliquid Perps (paper + live)
- Polymarket prediction markets

Recommendation

Use read-only API keys where possible, avoid granting withdrawal or trading permissions unless explicitly needed, and verify which accounts the agent can access.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A misconfigured pause threshold could unexpectedly stop or alter trading automation.

Why it was flagged

Auto-pausing is a purpose-aligned risk-control feature, but it could affect an autonomous trading workflow if implemented without clear user approval and threshold settings.

Skill content

Daily drawdown tracking with auto-pause at configurable threshold

Recommendation

Confirm pause thresholds and require user approval before the agent changes live trading-agent state.

Low

#ASI06: Memory and Context Poisoning

What this means

Exported CSV files may expose sensitive financial activity if stored insecurely or shared accidentally.

Why it was flagged

Exporting a ledger is expected for portfolio auditing, but it creates a persistent file containing trade and account history.

Skill content

CSV ledger export for full audit trail

Recommendation

Store exports in a private location, review files before sharing, and delete old exports when no longer needed.