A Clawdbot skill that gives your agent native access to DWLF — a market analysis platform for crypto and stocks.
v1.0.0Interact with DWLF (dwlf.co.uk), a market analysis platform for crypto and stocks. Use for: market data, price charts, technical indicators (EMA, RSI, DSS, S/R, trendlines, candlestick patterns, SMC), strategies (visual signal builder), backtesting, custom events, trade signals, portfolio tracking, watchlists, trade journaling, chart annotations, trade plans, position sizing, and academy content. Trigger on: market analysis, trading signals, backtests, portfolio, DWLF, chart indicators, support/resistance, strategy builder, trade journal, watchlist, chart annotations, trade plans, position sizing, how's BTC, how's the market.
⭐ 6· 2.9k·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's endpoints, examples, and included script match the described DWLF market-analysis purpose (market data, signals, annotations, backtests, etc.). However, the metadata does not declare the API key or other env vars even though the code requires DWLF_API_KEY and optionally DWLF_API_URL/TOOLS_MD. That omission is inconsistent with the stated purpose/requirements.
Instruction Scope
SKILL.md instructs the agent to call many read/write endpoints (create/update/delete annotations, trades, trade-plans, backtests). The included script will attempt to read a local TOOLS.md file to extract an API key (using a grep for the literal string "Jenna's own key"). That is a brittle, user-specific heuristic that causes the skill to read a local file for credentials and could inadvertently harvest other keys stored there. The rest of the instructions are within scope for a DWLF client.
Install Mechanism
No install spec (instruction-only with a small included helper script). This is low risk from arbitrary remote code installation — nothing is downloaded or executed beyond the packaged script and standard curl/jq usage.
Credentials
The skill requires an API key to operate, but requires.env and primary credential fields are empty in metadata. The runtime script reads DWLF_API_KEY and DWLF_API_URL env vars (and falls back to parsing TOOLS.md). Requesting access to an API key is proportionate, but not declaring it in metadata is inconsistent and the TOOLS.md parsing (with a hardcoded search for "Jenna's own key") is inappropriate and potentially exposes other secrets kept in that file.
Persistence & Privilege
always:false and no OS restrictions; the skill does not request permanent platform-wide presence and doesn't modify other skills or system settings. It can perform write actions on the DWLF account (annotations, trades, deletes) which is expected for a full-featured client — consider limiting agent autonomy (see guidance).
What to consider before installing
This skill appears to be a functional DWLF client, but review these points before installing:
- Credential handling: The helper script expects DWLF_API_KEY (and optionally DWLF_API_URL). The skill metadata does not declare that requirement — treat the absence as a packaging oversight. Provide the API key via the DWLF_API_KEY env var rather than storing it in a shared file.
- TOOLS.md parsing: The script attempts to grep your TOOLS.md for the literal phrase "Jenna's own key" to extract an API key. That is brittle and potentially dangerous if your TOOLS.md contains other credentials. If you must use a file, create a dedicated minimal file with only the DWLF key and point TOOLS_MD at it, or better: set DWLF_API_KEY in the environment.
- Write/delete capabilities: The skill exposes endpoints that can create/update/delete annotations, trades, trade-plans, and even purge signals. Only install if you trust the source and are comfortable granting an API key that can modify your DWLF account. Prefer creating an API key with the narrowest permissions possible (read-only if you only need reads).
- Source provenance: The skill's Source/Homepage are unknown; README points to a GitHub repo but registry source is not authoritative. If possible, inspect the full repo yourself, confirm authorship, and run the script locally to verify behavior before giving it network access.
- Autonomy: The agent can invoke the skill autonomously (platform default). Because the skill can perform destructive actions on your DWLF account, consider disabling autonomous invocation for this skill or requiring explicit approval for write operations.
If you proceed: set DWLF_API_KEY in a controlled env var, avoid placing other secrets in TOOLS.md, audit the included scripts, and issue a limited-scope API key that you can revoke if anything unexpected happens.Like a lobster shell, security has layers — review code before you run it.
latestvk970pa27kak5wy05twvztccbn980agtr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📊 Clawdis
Binscurl, jq
