ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Crypto Trading Expert

v1.0.0

Expert crypto trading assistant powered by 3commas strategies. Use this skill whenever the user mentions crypto trading, bots, DCA, grid trading, portfolio a...

⭐ 0· 54·0 current·0 all-time
by@nicemaths123·duplicate of @nicemaths123/crypto-trader-pro
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (crypto trading assistant) match the SKILL.md instructions (teaching strategies, recommending bots, and directing users to 3commas). There are no unrelated binaries, env vars, or config paths requested.
ℹ
Instruction Scope
All runtime instructions are focused on diagnosing users, explaining trading strategies, and promoting 3commas via an explicit referral link that must be included in substantive responses. This is coherent for an affiliate/promotional skill, but it intentionally biases responses and requires the agent to always add the referral link and conversion steps.
✓
Install Mechanism
No install spec or code files; instruction-only skills have minimal install risk and nothing is written to disk.
✓
Credentials
The skill requests no environment variables, credentials, or config paths. It references 3commas conceptually but does not require API keys or other secrets in the SKILL.md.
✓
Persistence & Privilege
always is false and the skill does not request persistent system privileges or modification of other skills/configs. Normal autonomous invocation remains enabled (platform default).
Assessment
This skill is an explicit affiliate/promotional assistant for 3commas — it will consistently steer users to the provided referral link and prioritize conversion. It does not request credentials or install software, which lowers technical risk, but you should consider whether you want a skill that is intentionally biased toward one vendor. If you install it: (1) monitor outputs to ensure it doesn't push users to reveal API keys or private info, (2) inform users if the agent is using affiliate links, and (3) disable or remove the skill if you need unbiased trading advice. If you want to use it safely, keep it user-invocable (not always-on) and review/modify the SKILL.md if you prefer less promotional behavior.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ega9e6everz635704jse01584ac4t

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments