Trade History

Read and display recent trade history from local JSONL log file. Use when asked about past trades, trade recap, performance review, or to list recorded signals.

Security Scan

The skill claims to read a local trades.jsonl but its runtime instructions call an external Python script and a hard-coded user path that are not included in the skill bundle, creating a mismatch and execution risk.

Purpose & Capability

Stated purpose (read/display local JSONL trade log) is plausible and the only declared runtime dependency is python3, which is proportional. However the SKILL.md hard-codes a specific log location (/home/windows_11/.openclaw/...) and a path to a read.py under ~/.npm-global/lib/node_modules/openclaw/skills/trade-history/read.py that is not part of this skill package — that is inconsistent with an instruction-only skill which should either operate on files already present or include the small script it needs.

Instruction Scope

The instructions tell the agent to execute a local Python script at a specific global path. The skill bundle contains no code to review, so the actual behavior of that script is unknown — it could read only the trades file or perform arbitrary actions. The SKILL.md also embeds a user-specific absolute log path rather than a configurable or relative path, limiting portability and raising the chance of unintended file access.

Install Mechanism

No install spec (instruction-only) is lower risk in general, but here it's problematic: the instructions assume a particular script is already installed under ~/.npm-global/lib/node_modules/... even though the registry package includes no files. That implicit dependency makes behavior environment-dependent and unverifiable.

Credentials

The skill requests no environment variables or credentials, which is appropriate. However, it references a hard-coded home-directory path and a global npm path; executing an unknown script with access to the filesystem without explicit bounds is disproportionate to the simple task of reading a JSONL file. The SKILL.md's guarantee (read-only, never modify) cannot be verified from the available materials.

Persistence & Privilege

The skill does not request 'always: true' and is user-invocable only; it does not request persistent privileges or modify other skills. Autonomous invocation remains possible (platform default) but is not combined here with elevated privileges.

Scan Findings in Context

[no_code_files_in_bundle] unexpected: The static scanner found no files to analyze. That is allowed for instruction-only skills, but SKILL.md references a read.py script that is not included—this mismatch is unexpected and prevents code review.

What to consider before installing

Do not run this skill until you verify the referenced Python script and the log path. Specifically: (1) Inspect the file ~/.npm-global/lib/node_modules/openclaw/skills/trade-history/read.py — do not execute it if you cannot review its contents; (2) Confirm or change the hard-coded log path (/home/windows_11/...) to a location you control, or require the skill accept a user-specified path; (3) Prefer a skill that includes its small read script in the package so you can review the code before execution; (4) If you must run it, run the script in a safe environment (non-production account, limited filesystem permissions) and back up the trades.jsonl file first. The main concerns are the missing script (unknown behavior) and the hard-coded absolute path that may read unexpected files.

Read and display recorded trade events from the local trades.jsonl log file, with optional filtering by symbol and configurable limit.

When to Use

• User asks: "tampilkan trade history"
• User asks: "trade apa saja yang sudah dicatat?"
• User asks: "recap trade BTC terakhir"
• User asks: "lihat 10 trade terakhir"
• User asks: "ada berapa trade yang tersimpan?"

How It Works

This skill runs a local Python script that:

1. Reads the local trades.jsonl file line by line.
2. Parses each line as a JSON object.
3. Filters by symbol if specified.
4. Sorts results newest first (reverse chronological).
5. Returns up to N records (default 20).
6. Returns a JSON object with count and items array.

Workflow

Step 1 — Run the read script via bash tool: python3 ~/.npm-global/lib/node_modules/openclaw/skills/trade-history/read.py

Step 2 — Parse the JSON output (count + items array).

Step 3 — Present the trade list to the user in a readable format:

• Show each trade: symbol, side, entry, sl, tp, note, timestamp
• Mention total count
• Newest trades first

Optional Arguments

Run with JSON args to filter or limit results: python3 ~/.npm-global/lib/node_modules/openclaw/skills/trade-history/read.py '{"limit": 10, "symbol": "BTCUSDT"}'

Supported args:

• limit: number of trades to return (default 20)
• symbol: filter by trading pair (e.g. BTCUSDT)

Output Format

{ "count": 3, "items": [ { "symbol": "BTCUSDT", "side": "BUY", "entry": 94500, "sl": 94000, "tp": 95500, "note": "sweep+fvg signal", "source": "btc-analyzer", "ts": "2026-02-23T00:00:00Z" } ] }

Log File Location

/home/windows_11/.openclaw/polymarket-workspace/trades.jsonl

Error Handling

If log file does not exist yet: {"count": 0, "items": []}

No error is thrown — returns empty result gracefully.

Guardrails

• Always run the script — never fabricate trade history.
• If file is missing, return empty list gracefully without error.
• Output must be JSON only from the script.
• Always display newest trades first (reverse chronological order).
• Never delete or modify the log file — read only.