Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Groww

Trade stocks and manage portfolio on Groww (Indian broker). Use when user asks about Indian stocks, NSE/BSE prices, portfolio holdings, placing buy/sell orders, checking order status, or any Groww-related trading queries. Supports live quotes, LTP, OHLC, historical candles, and order management.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 670 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name, description, SKILL.md, and _meta.json consistently describe a Groww trading integration and the use of a GROWW_API_KEY — that credential is appropriate for the stated purpose. However, the registry summary you provided earlier reported no required env vars/primary credential, which conflicts with the included _meta.json and SKILL.md. This inconsistency is unexplained and should be clarified with the publisher.
Instruction Scope
SKILL.md limits actions to Groww portfolio, market-data, and order endpoints and shows example curl commands using GROWW_API_KEY. It does not instruct reading unrelated files or other credentials. Concern: it references a 'groww-mcp' server and mcporter calls with no install or provenance information for that server/tool; that gap makes runtime behavior ambiguous (where are these calls routed and who operates the MCP server?).
Install Mechanism
Instruction-only skill with no install spec or code files — lowest-risk install mechanism. Nothing is downloaded or written to disk by the skill itself.
Credentials
The only credential referenced (GROWW_API_KEY / primaryEnv in _meta.json and SKILL.md) is proportionate to a trading integration. However, the registry/summary metadata you provided earlier claimed no required env vars — this mismatch is suspicious and should be resolved. No other secrets or unrelated environment access are requested.
Persistence & Privilege
always is false and there is no install step that requests persistent system presence or modifies other skills/configs. The skill would run only when invoked (or autonomously if the agent chooses to call it, which is the platform default).
What to consider before installing
This skill appears to do what it says (use a Groww API key to query market data and place orders), but before installing or supplying any API key: 1) Verify the skill publisher and ask why registry metadata omitted the required GROWW_API_KEY while the included _meta.json and SKILL.md require it. 2) Confirm whether the Groww API endpoints and the 'groww-mcp' mcporter service are legitimate and who operates them — mcporter calls point to an external server; understand where your requests (and keys) will be sent. 3) Limit privileges: if Groww supports scoped or sandbox keys, use those for testing; avoid giving a full-permission live trading key until you trust the skill. 4) Test with read-only operations (portfolio, quotes) before enabling order placement. 5) If you cannot verify the MCP server provenance or the registry metadata discrepancy, do not install or provide your GROWW_API_KEY. If you contact the publisher, ask for a clear explanation and for the origin of the groww-mcp server and mcporter tooling.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk972y5fankfrb4dkhx85q0xesx80w0g1

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Groww Trading

Trade Indian stocks via Groww. Supports portfolio management, market data, and order execution.

Setup

  1. Get API key from Groww app: Stocks → Settings → API Trading → Generate API key
  2. Add to OpenClaw config:
    openclaw configure
    # Add env: GROWW_API_KEY=your_key_here
    

MCP Server Usage

The groww-mcp server is configured. Call tools via mcporter:

# Portfolio
mcporter call groww-mcp.portfolio

# Market data
mcporter call groww-mcp.market-data action=live-quote symbol=TATAMOTORS
mcporter call groww-mcp.market-data action=ltp symbols=TATAMOTORS,RELIANCE
mcporter call groww-mcp.market-data action=ohlc symbol=TCS

# Orders
mcporter call groww-mcp.place_order symbol=TATAMOTORS quantity=10 side=BUY type=MARKET
mcporter call groww-mcp.order_status orderId=ABC123
mcporter call groww-mcp.cancel_order orderId=ABC123

Direct API (Alternative)

If MCP has issues, use the Groww API directly:

Base URL

https://api.groww.in/v1/

Headers

Authorization: Bearer $GROWW_API_KEY
Accept: application/json
Content-Type: application/json

Endpoints

Portfolio/Holdings:

curl -H "Authorization: Bearer $GROWW_API_KEY" -H "Accept: application/json" \
  "https://api.groww.in/v1/holdings/user"

Live Quote:

curl -H "Authorization: Bearer $GROWW_API_KEY" -H "Accept: application/json" \
  "https://api.groww.in/v1/live-data/quote?exchange=NSE&segment=CASH&trading_symbol=TATAMOTORS"

LTP (Last Traded Price):

curl -H "Authorization: Bearer $GROWW_API_KEY" -H "Accept: application/json" \
  "https://api.groww.in/v1/live-data/ltp?segment=CASH&exchange_symbols=NSE:TATAMOTORS,NSE:RELIANCE"

OHLC:

curl -H "Authorization: Bearer $GROWW_API_KEY" -H "Accept: application/json" \
  "https://api.groww.in/v1/live-data/ohlc?segment=CASH&exchange_symbols=NSE:TATAMOTORS"

Historical Candles:

curl -H "Authorization: Bearer $GROWW_API_KEY" -H "Accept: application/json" \
  "https://api.groww.in/v1/historical/candle/range?exchange=NSE&segment=CASH&trading_symbol=TATAMOTORS&interval=5m&start_time=2024-06-01T09:15:00&end_time=2024-06-01T15:30:00"

Place Order:

curl -X POST -H "Authorization: Bearer $GROWW_API_KEY" \
  -H "Accept: application/json" -H "Content-Type: application/json" \
  -d '{"trading_symbol":"TATAMOTORS","quantity":10,"validity":"DAY","exchange":"NSE","segment":"CASH","product":"CNC","order_type":"MARKET","transaction_type":"BUY"}' \
  "https://api.groww.in/v1/order/create"

Order Status:

curl -H "Authorization: Bearer $GROWW_API_KEY" -H "Accept: application/json" \
  "https://api.groww.in/v1/order/detail/{groww_order_id}?segment=CASH"

Cancel Order:

curl -X POST -H "Authorization: Bearer $GROWW_API_KEY" \
  -H "Accept: application/json" -H "Content-Type: application/json" \
  -d '{"segment":"CASH","groww_order_id":"ABC123"}' \
  "https://api.groww.in/v1/order/cancel"

Stock Symbols

Use NSE trading symbols:

  • TATAMOTORS, RELIANCE, TCS, INFY, HDFCBANK
  • WIPRO, ICICIBANK, SBIN, BHARTIARTL, ITC

Market Hours

  • Pre-open: 9:00 - 9:15 AM IST
  • Trading: 9:15 AM - 3:30 PM IST
  • Monday to Friday (except holidays)

Example Queries

  • "Show my Groww portfolio"
  • "What's TATAMOTORS price?"
  • "Buy 10 RELIANCE shares"
  • "Sell 5 TCS at limit 4200"
  • "Cancel order ABC123"
  • "Get historical data for INFY"

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…