Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

DAX Ledger Skills

v1.0.0

Use the DAX Ledger API to authenticate, list portfolios, retrieve portfolio KPIs, list findings, retrieve position snapshots, and list/filter transactions wi...

0· 0·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The SKILL.md describes a DAX Ledger API integration (auth, portfolios, KPIs, transactions)—that purpose matches the endpoints documented. However, the registry metadata lists no required environment variables or primary credential while the instructions clearly require an API key and secret. That mismatch is disproportionate to the stated purpose and could cause unexpected behavior or hidden access attempts.
Instruction Scope
Runtime instructions are limited to calling the documented DAX Ledger endpoints and using an auth token obtained from DAXLEDGER_API_KEY/DAXLEDGER_API_SECRET. The instructions do not ask for unrelated files, system paths, or additional credentials. The main issue is that the instructions reference environment variables that the registry did not declare.
Install Mechanism
This is an instruction-only skill with no install spec and no code files; nothing is written to disk by an installer, which minimizes installation risk.
!
Credentials
The only secrets the skill needs (API key and secret) are proportionate to the described API integration. However, those env vars are not declared in the skill's metadata (Required env vars: none). That inconsistency is a red flag: the agent may attempt to read environment variables that were not advertised, and a user cannot review or control requested secrets from the registry view.
Persistence & Privilege
The skill does not request persistent presence (always:false) and does not modify other skills or system-wide settings per the provided files.
What to consider before installing
Do not install or provide credentials yet. The SKILL.md expects two environment variables (DAXLEDGER_API_KEY and DAXLEDGER_API_SECRET) but the registry metadata lists none—ask the publisher to correct the metadata and explain how those secrets will be used and stored. Confirm the skill's source and homepage (both are unknown). If you proceed, create a least-privilege test API key on DAX Ledger, verify calls are only made to https://app.daxledger.io, and never reuse production credentials until the metadata and owner identity are validated.

Like a lobster shell, security has layers — review code before you run it.

latestvk97d8cy0pwjy3txjy0591q626s843y6y

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

DAX Ledger API

Base URL
https://app.daxledger.io


Environment Variables

VariableDescription
DAXLEDGER_API_KEYAPI key used to authenticate
DAXLEDGER_API_SECRETAPI secret used to authenticate

TL;DR — Best Practice

To get the aggregated portfolio valuation in a fast and canonical way, use:

  • GET /api/portfolio/{portfolioId}/position_snapshot/graph?span={n} Example: span=7 for 7 days.
    To get historical data for a specific token when asset-level detail is needed, use:
  • GET /api/portfolio/{portfolioId}/position_snapshot/graph/{ticker}?span={n}
  • Practical rule: by default, automations/agents should use the aggregated endpoint. Only use per-ticker aggregation when it is explicitly requested (force_by_ticker=true) or when granular asset-level analysis is required.

Authentication

POST /api/auth/external_api

Body:

{ "APIKey": "{{DAXLEDGER_API_KEY}}", "APISecret": "{{DAXLEDGER_API_SECRET}}" }

Response:

{ "token": "your_access_token_here" }

Header for authenticated calls:

Authorization: Bearer {{token}}


Pick Your Endpoint

You needEndpointRef
AuthenticatePOST /api/auth/external_apireferences/apis.md
List portfoliosGET /api/portfoliosreferences/apis.md
Get KPIsGET /api/portfolio/{portfolioId}/kpis/portfolioreferences/apis.md
Get findings (problems in portfolio)GET /api/portfolio/{portfolioId}/findings?page=1&pageSize=20references/apis.md
Get finding by rule idGET /api/portfolio/{portfolioId}/finding/{ruleId}references/apis.md
Get position snapshot (balances and values)GET /api/portfolio/{portfolioId}/position_snapshot?page=1&pageSize=20references/apis.md
Get portfolio position (variation) graphGET /api/portfolio/{portfolioId}/position_snapshot/graph?span=30references/apis.md
Get token position graph (variation)GET /api/portfolio/{portfolioId}/position_snapshot/graph/{ticker}?span=30references/apis.md
Get DeFi positionsGET /api/portfolio/{portfolioId}/positions_report/defireferences/apis.md
Get capital gains reportGET /api/portfolio/{portfolioId}/capital_gains_report?page=1&pageSize=20references/apis.md
Get capital gains available filtersGET /api/portfolio/{portfolioId}/capital_gains_report/filtersreferences/apis.md
Get sanity check reportGET /api/portfolio/{portfolioId}/sanity_check_report?page=1&pageSize=20references/apis.md
Get calculation summary reportGET /api/portfolio/{portfolioId}/calculation_summary_report?page=1&pageSize=20references/apis.md
Get fiscal reportGET /api/portfolio/{portfolioId}/fiscal_report?page=1&pageSize=20references/apis.md
List transactionsGET /api/portfolio/{portfolioId}/transactions?page=1&pageSize=20references/apis.md
Filter transactionsGET /api/portfolio/{portfolioId}/transactions?filter=<BASE64>references/apis.md
Get compliance reportGET /api/portfolio/{portfolioId}/compliance?page=1&pageSize=20references/apis.md

Transactions

Endpoint

GET /api/portfolio/{portfolioId}/transactions

Query params

page
pageSize
filter


Findings

List Findings

Endpoint

GET /api/portfolio/{portfolioId}/findings

Query params

page
pageSize

Use this endpoint when the user asks for problems or findings in a portfolio.


Finding By Rule Id

Endpoint

GET /api/portfolio/{portfolioId}/finding/{ruleId}

Use this endpoint when the user asks for findings tied to a specific rule/identifier returned in findings.


Position Snapshot

Positions Snapshot (balances and values)

Endpoint

GET /api/portfolio/{portfolioId}/position_snapshot

Query params

page
pageSize
filter
sort

Use this endpoint when the user asks about token balance or token value.


Position Snapshot Graph (Overall)

Endpoint

GET /api/portfolio/{portfolioId}/position_snapshot/graph/

Query params

span (7, 30, 365, -1)

Use this endpoint when the user asks about variation in balance over time or on a specific date range.


Position Snapshot Graph By Ticker

Endpoint

GET /api/portfolio/{portfolioId}/position_snapshot/graph/{ticker}

Query params

span (7, 30, 365, -1)

Use this endpoint when the user asks about a specific token holding over time or on a specific date range.


DeFi Positions

Endpoint

GET /api/portfolio/{portfolioId}/positions_report/defi

Use this endpoint when the user asks to retrieve all DeFi positions.


Compliance

Portfolio Compliance

Endpoint

GET /api/portfolio/{portfolioId}/compliance

Query params

page
pageSize
filter

Use this endpoint when the user asks about:

  • classified addresses
  • unclassified addresses
  • compliance issues
  • compliance status of addresses
  • blockchain address compliance

Reports

Capital Gains Report

Endpoint

GET /api/portfolio/{portfolioId}/capital_gains_report

Available filters endpoint

GET /api/portfolio/{portfolioId}/capital_gains_report/filters

Query params

page
pageSize
filter
sort

Use this endpoint when the user asks for gains/losses by asset and realized/unrealized values.

Capital gains filters:

  • digitalAssetTicker (operator: contains_in)
  • report_year (operator: =)
  • portfolioConnection (operator: =)

If isSeparateSetting=true in capital gains response, run the endpoint with several filters using the values from /capital_gains_report/filters to retrieve separate results.


Sanity Check Report

Endpoint

GET /api/portfolio/{portfolioId}/sanity_check_report

Query params

page
pageSize

Use this endpoint when the user asks for balance mismatches between calculated and reported balances.


Calculation Summary Report

Endpoint

GET /api/portfolio/{portfolioId}/calculation_summary_report

Query params

page
pageSize
filter
sort

Use this endpoint when the user asks for high-level calculated totals and summary metrics.


Fiscal Report

Endpoint

GET /api/portfolio/{portfolioId}/fiscal_report

Query params

page
pageSize
filter
sort

Use this endpoint when the user asks for fiscal/tax line items with acquisition, sale, and holding details.


Transaction Filters

Filters must be encoded with Base64 before sending.


Transaction Hash

Operator: contains

{"transactionHash":{"operator":"contains","value":"123456789"}}


Transaction Date

Operator: between

{"transactionDate":{"operator":"between","value":{"startDate":"2026-03-01","endDate":"2026-03-02"}}}


Transaction Type

Operator: contains_in

{"transactionType":{"operator":"contains_in","value":["computed-reward"]}}

Available transaction types:

  • airdrop
  • bonus
  • computed-deposit
  • computed-reward
  • deposit
  • other
  • reward
  • staking
  • trade
  • unknown
  • unstaking
  • withdrawal

Combining Multiple Filters

Multiple filters can be applied in the same JSON object.

Example combining:

  • transaction hash
  • transaction type
  • transaction date

Example JSON:

{ "transactionHash": { "operator": "contains", "value": "123456" }, "transactionType": { "operator": "contains_in", "value": ["trade","deposit"] }, "transactionDate": { "operator": "between", "value": { "startDate": "2026-03-01", "endDate": "2026-03-31" } } }

Encode this JSON to Base64 and pass it as:

GET /api/portfolio/{portfolioId}/transactions?filter=<BASE64>&page=1&pageSize=20


Encoding Filters

Browser

btoa(JSON.stringify(filter))

Node

Buffer.from(JSON.stringify(filter)).toString("base64")


Epoch Fields

If an API field is an epoch timestamp, convert it to ISO date before returning it to the user.

Rule:

  • 10 digits -> seconds
  • 13 digits -> milliseconds

Example (Node):

new Date(Number(epoch) < 1e12 ? Number(epoch) * 1000 : Number(epoch)).toISOString()


Pagination

page starts at 1

pageSize default = 20

Continue requesting pages while:

items.length < total


References

references/apis.md

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…