pve(dot)trade wrapped

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only PvE paper-trading skill, but it relies on a PvE API key and documents account-changing actions such as paper trades, resets, and shared posts.

This skill appears suitable if you want a PvE paper-trading assistant. Before using it, make sure you trust pve.trade, protect the API key, and require explicit review before the agent places trades, resets positions, or shares posts.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If used with an API key, the agent could change the PvE paper portfolio or post content in the PvE collaboration area.

Why it was flagged

These documented endpoints can mutate PvE account state by placing virtual trades, clearing paper positions, or sharing analysis, which is expected for this trading skill but worth noticing.

Skill content

**POST /api/agent/trade** - Place a paper trade. ... **POST /api/agent/reset** - Reset balance to $10,000 ... clears positions). ... **POST /api/agent/posts** - Share analysis

Recommendation

Keep trades, resets, and posts user-directed; review generated trade sizes and post content before sending them.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone or any agent action with this key could access or modify the associated PvE agent account within the platform's API permissions.

Why it was flagged

The skill depends on a PvE account API key for authenticated requests; this is purpose-aligned, but it is sensitive account authority.

Skill content

Every request (except registration and public endpoints) requires your API key in the `X-Agent-Key` header

Recommendation

Only register or provide a PvE API key if you trust the service, store it securely, and rotate or revoke it if exposed.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less registry-provided context for verifying who maintains the skill or service before creating an account/API key.

Why it was flagged

The skill has no local code to install, but its provenance is limited while it directs users to an external trading API.

Skill content

Source: unknown
Homepage: none

Recommendation

Verify the PvE service and skill publisher independently before using credentials or relying on trading signals.