ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

TradeAlpha开放平台

v0.4.0

Route natural-language requests about today's news, market news, TradeAlpha news, or TradeAlpha login into the bundled TradeAlpha plugin tools. Prefer the si...

⭐ 0· 58·0 current·0 all-time
by@jiuwei2

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jiuwei2/tradealpha-open-platform.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "TradeAlpha开放平台" (jiuwei2/tradealpha-open-platform) from ClawHub.
Skill page: https://clawhub.ai/jiuwei2/tradealpha-open-platform
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install tradealpha-open-platform

ClawHub CLI

Package manager switcher

npx clawhub@latest install tradealpha-open-platform
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (TradeAlpha news + login router) matches the code and SKILL.md. Required binary (node) is appropriate. Declared primary credential TRADEALPHA_API_KEY is used by the code. The included tools, scripts, and parameters align with a news/login router.
✓
Instruction Scope
SKILL.md instructs the agent to route natural language news/login intents to the bundled router tool, ask the user for account/password when required, and never echo passwords/tokens. The runtime instructions and code only reference the declared config path (~/.config/tradealpha-open-platform/config.json), env var TRADEALPHA_API_KEY, and the remote API endpoints — all within scope.
✓
Install Mechanism
This is instruction-only for installation (no external download/install steps). The package contains local Node scripts and plugin files (no remote install URLs). No untrusted download/extract behavior was found.
ℹ
Credentials
The only declared credential is TRADEALPHA_API_KEY, which is used as expected. The plugin runs bundled Node scripts via execFile and passes process.env through to child processes — this means any environment variables present in the agent process would be visible to the child scripts. The shipped scripts themselves only read TRADEALPHA_API_KEY and the local config file, so additional envs are not used by current code, but the child inherits the full environment.
✓
Persistence & Privilege
The skill does not request always:true and does not modify other skills. It persists the retrieved apiToken to a local config file (~/.config/tradealpha-open-platform/config.json) with file mode 0o600, which is consistent with its login-first design. openclaw.plugin.json marks the plugin enabledByDefault true (manifest-level), which is normal but worth noting.
Assessment
This skill appears to do what it claims: it will ask for your TradeAlpha account/password (or use TRADEALPHA_API_KEY), POST those to https://quantaccess.lxaa.top login/news APIs, and save the returned api_token to ~/.config/tradealpha-open-platform/config.json. Before installing, confirm you trust the remote host (quantaccess.lxaa.top) because your login credentials and token will be transmitted to that service. If you prefer not to type your password into the agent, set TRADEALPHA_API_KEY in the environment instead. Note also that the plugin launches bundled Node scripts and passes the agent process environment through to those child processes — while the shipped scripts only use TRADEALPHA_API_KEY and the local config, inheriting the full env means a malicious change to the scripts could access other env secrets. If you have sensitive environment variables or reuse passwords, rotate credentials after use and consider reviewing the included scripts (they are present in the package) or running this skill in an isolated environment.
✗
scripts/get-realtime-news.js:59
Environment variable access combined with network send.
!
scripts/get-realtime-news.js:75
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📰 Clawdis
Binsnode
Primary envTRADEALPHA_API_KEY
latestvk974ft3dkaj9dtmmp2gc0hmh1d85mwk9
58downloads
0stars
5versions
Updated 18h ago
v0.4.0
MIT-0
@jiuwei2
latest
Download

TradeAlpha开放平台

TradeAlpha开放平台：路透、彭博、川普 Truth、国内主流消息源，一网打尽。

TradeAlpha Open Platform: Reuters, Bloomberg, Trump's Truth Social, and major Chinese news sources, all in one place.

这个 skill 只负责自然语言召回和登录门控，真正执行依赖同名插件里的真实工具。不要把 tradealpha-open-platform 当成 tool 名调用；应优先调用插件总入口 tradealpha_open_platform。

First Rule

每次用户想使用 TradeAlpha 新闻能力时，都遵守下面的固定顺序：

  1. 用户想登录、获取 token、刷新 token 时，先向用户索要账号和密码
  2. 调用 tradealpha_open_platform，并传 intent: "login"
  3. 用户想拉新闻时，优先调用 tradealpha_open_platform
  4. 如果 tradealpha_open_platform 返回 auth_required: true
  5. 立即向用户索要账号和密码
  6. 再次调用 tradealpha_open_platform，补上账号和密码
  7. 登录成功后再重试新闻请求

如果用户提到以下任一意图，应优先触发本技能：

  • 今天的新闻
  • 今日新闻
  • 现在的新闻
  • 市场新闻
  • 宏观新闻
  • 路透新闻
  • 彭博新闻
  • Truth 新闻
  • 国内新闻快讯
  • 登录 TradeAlpha
  • 获取 token
  • 初始化或刷新 token
  • 配置 TradeAlpha 权限
  • 拉取实时新闻
  • 按来源、分类、重要程度筛选新闻

不要说“没有 tradealpha 这个工具”。当前应优先使用的真实工具是：

  • tradealpha_open_platform
  • tradealpha_login（辅助）
  • tradealpha_news（辅助）
  • tradealpha_realtime_news（兼容别名，优先仍用 tradealpha_news）

When To Use

在这些场景使用本技能：

  • 用户直接说“我要今天的新闻”“帮我拉今天新闻”
  • 用户直接说“帮我看市场新闻”“帮我拉彭博/路透新闻”
  • 用户要先登录或初始化 token
  • 用户要更新、刷新、重新获取 token
  • 用户要抓取实时新闻
  • 用户要按来源、重要程度、分类筛选新闻
  • 用户要对比彭博、路透、Truth、国内源口径
  • 用户要获取近 24 小时或指定时间段内的市场新闻

Routing Rules

登录场景

如果用户要登录、初始化 token、刷新 token：

  1. 向用户索要 account 和 password
  2. 调用 tradealpha_open_platform，传 intent: "login"、account、password
  3. 登录成功后再继续后续新闻请求

拉新闻场景

如果用户要新闻：

  1. 直接调用 tradealpha_open_platform
  2. 如果返回 auth_required: false，继续整理新闻结果
  3. 如果返回 auth_required: true，向用户索要 account 和 password
  4. 再次调用 tradealpha_open_platform，携带 account 和 password
  5. 如果用户只想单独登录，也可以调用 tradealpha_open_platform 并传 intent: "login"

新闻工具常用参数

  • intent
  • timeframe
  • start_time
  • end_time
  • source
  • category
  • level
  • page
  • page_size

Runtime Rules

  • 先走插件总入口 tradealpha_open_platform，不要回退到 shell 脚本
  • 对“今天新闻”“今日新闻”“拉新闻”这类自然语言，默认视为要用本 skill
  • 如果工具返回 auth_required: true，必须先登录，不能跳过
  • 登录前不要假设用户已经有 token
  • 返回结果是 JSON，先读 details / JSON 再总结给用户
  • 不要在回复里回显用户密码或 token
  • 新闻通常存在 0-5 分钟客观延迟

Comments

Loading comments...