Boktoshi Bot Trading Skill

WarnAudited by ClawScan on May 10, 2026.

Overview

This is coherently a Boktoshi bot-trading skill, but it can place or close trades with an API key and does not describe clear approval or limit safeguards.

Install only if you intend to let the agent interact with your Boktoshi/MechaTradeClub bot account. Use a limited bot-only API key, require explicit confirmation for each trade or position close, set clear size/risk limits, and rotate the key if it is ever exposed.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

High

#ASI02: Tool Misuse and Exploitation

What this means

An agent could place trades, close positions, or claim rewards on the connected account if invoked on ambiguous or mistaken instructions.

Why it was flagged

These are state-changing trading/account actions. The artifact does not provide approval, size, market, dry-run, or containment rules before an agent uses them.

Skill content

- `POST /bots/trade`
- `POST /bots/positions/:positionId/close`
- `POST /bots/claim-boks`

Recommendation

Use this only with explicit per-action user approval, clear trade parameters, small limits, and a least-privileged API key.

Medium

#ASI03: Identity and Privilege Abuse

What this means

If the key is exposed or over-permissioned, someone could act through the connected trading account.

Why it was flagged

The bearer API key is expected for the MechaTradeClub API and is disclosed, but it is a sensitive credential that authorizes account actions.

Skill content

- `MTC_API_KEY` (required)
  - Header format:
    - `Authorization: Bearer mtc_live_<your-key>`

Recommendation

Use a scoped, revocable bot-only key if available, avoid sharing it in chat/logs, and rotate it immediately if exposed.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less assurance about who maintains the skill or whether external documentation matches the reviewed artifact.

Why it was flagged

The reviewed package is instruction-only and has no source or homepage provenance in the supplied metadata, which limits independent verification for a high-impact trading integration.

Skill content

Source: unknown
Homepage: none

Recommendation

Verify the publisher and the Boktoshi/MechaTradeClub documentation before connecting a live trading key.