Alpaca Trading
WarnAudited by ClawScan on May 10, 2026.
Overview
This appears to be a coherent Alpaca trading helper, but it should be reviewed carefully because it can place, cancel, exercise, and close real financial positions when live credentials are configured.
Only install this if you intentionally want an agent to help operate an Alpaca account. Keep the default paper endpoint unless you are ready for live trading, require explicit approval before every live trade or bulk account action, and verify the source before providing API keys.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If live Alpaca credentials are configured, an incorrect or overly broad agent action could place trades, cancel orders, exercise options, or close positions with real financial consequences.
The skill exposes high-impact financial mutations, including bulk cancellation and closing all positions, while only documenting confirmation for switching to live mode rather than for each trade or destructive bulk action.
Paper trading is the default. Always confirm with the user before switching to live. ... alpaca DELETE /v2/orders # cancel ALL ... alpaca DELETE '/v2/positions?cancel_orders=true' # close ALL
Use paper trading by default, require explicit user confirmation for every live order and every bulk action, and consider adding guardrails such as order-size limits, dry-run previews, and separate paper/live credentials.
Users may not see from the registry metadata that the skill needs Alpaca API credentials capable of accessing or trading in their account.
SKILL.md requires APCA_API_KEY_ID and APCA_API_SECRET_KEY, so the registry metadata under-declares the credential requirement for a financial trading account.
Required env vars: none ... Primary credential: none
Declare the Alpaca API key and secret in metadata, and use least-privilege or separate paper/live keys where Alpaca supports it.
It may be harder to confirm that the skill comes from the expected maintainer or repository before trusting it with trading credentials.
For a high-impact financial trading skill, missing source and homepage metadata makes maintainer provenance harder to verify, although the provided helper script is visible and no automatic installer is shown.
Source: unknown; Homepage: none
Review the included script before use and prefer installing from a verified repository or publisher for financial-account integrations.