Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

HFT Paper Trader Pro

v1.1.0

High-frequency paper trading framework for crypto. Multi-indicator TA scoring (RSI/MACD/EMA/BB/OBV/StochRSI), dual-regime filter (15m fast + 4h macro), posit...

0· 208·0 current·0 all-time
byZero2Ai@zero2ai-hub

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for zero2ai-hub/hft-paper-trader-pro.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "HFT Paper Trader Pro" (zero2ai-hub/hft-paper-trader-pro) from ClawHub.
Skill page: https://clawhub.ai/zero2ai-hub/hft-paper-trader-pro
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install hft-paper-trader-pro

ClawHub CLI

Package manager switcher

npx clawhub@latest install hft-paper-trader-pro
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
SKILL.md describes a coherent paper-trading framework (TA indicators, regime filters, file-based portfolio/ledger). That functionality does not require extra credentials or installers, so the declared lack of required env vars/install is plausible. However registry metadata (slug/version/owner) does not match _meta.json and SKILL.md (registry lists 'hft-paper-trader-pro' v1.1.0 while _meta.json and SKILL.md show different slugs/versions/owner), and there is no homepage or source URL — this provenance mismatch is unusual and unexplained.
Instruction Scope
The SKILL.md is instruction-only and describes reading market data from 'Binance public API' and writing local files (portfolio.json, journal.json, observations.md). Those actions are consistent with paper trading. But instructions are high-level and vague (no explicit endpoints, no commands, no code), and the 'self-improvement loop' / 'lessons captured after each loss' is underspecified (no target for telemetry or model training). Vague instructions can give an agent broad discretion to call external endpoints or aggregate and transmit data if implemented later.
Install Mechanism
No install spec and no code files — lowest-risk packaging pattern. Nothing will be written to disk by an installer at install time. The security surface is entirely the SKILL.md instructions when the agent runs.
Credentials
The skill declares no required environment variables or credentials, which is reasonable for public-market-data-only paper trading. However, SKILL.md references 'Binance public API' (some Binance endpoints require keys/rate-limited access) and an autonomous/self-improvement loop that might need remote storage or credentials; the absence of any declared env vars or endpoints leaves ambiguity about what secrets (if any) might be needed or used by an implementation.
Persistence & Privilege
Flags are default (always:false, user-invocable:true, model invocation allowed). The skill will not be force-included system-wide. It will be able to act autonomously if invoked, which is normal for skills; this combination alone is not a red flag.
What to consider before installing
Do not install or run this skill without additional verification. Key actions to take before trusting it: 1) Ask the publisher for the full source code or a canonical repository/homepage and confirm the owner identity (the registry metadata, SKILL.md, and _meta.json contain inconsistent owner/slug/version values). 2) Request explicit details about any external endpoints used by the 'self-improvement loop' (where lessons are sent/stored); disallow any unexpected network exfiltration. 3) Run the skill in an isolated environment (no access to sensitive network segments or credentials) and monitor outbound connections; ensure it only calls public Binance endpoints you expect. 4) Inspect any implementation for network calls, hardcoded URLs, or code that reads other credentials or system files. 5) Do not connect any real exchange accounts or real funds — this is described as paper trading. 6) If you need autonomous execution, prefer skills with a public repo, clear provenance, and reproducible builds; if the author can’t or won’t provide source/clarity, treat the skill as untrusted.

Like a lobster shell, security has layers — review code before you run it.

latestvk97b6671rnz612zc1k2jkfttqn83404g
208downloads
0stars
1versions
Updated 3h ago
v1.1.0
MIT-0

HFT Paper Trader — Autonomous Crypto Trading Framework

A complete high-frequency paper trading system for building and testing autonomous crypto trading agents.

Architecture

Market Data (Binance public API)
    ↓
TA Engine (RSI + MACD + EMA + BB + OBV + StochRSI)
    ↓
Signal Score (-10 to +10)
    ↓
Dual Regime Filter (15m EMA8/21 fast + 4h EMA20/50 macro)
    ↓
Kelly Position Sizer (3% max risk per trade)
    ↓
Paper Portfolio Manager (portfolio.json)
    ↓
Trade Ledger (journal.json) + Auto-Observation Logger (observations.md)

Features

  • Multi-indicator confluence: 7 indicators combined into one score
  • Dual regime filter: 15m EMA8/21 (fast) gates entries alongside 4h EMA20/50 (macro) — prevents trading against short-term trend
  • OBV divergence detection: hidden accumulation/distribution
  • Quarter-Kelly sizing: conservative risk management
  • Correct SL placement: Math.max caps risk at 3% — fixes bug where SL ran 5–11% instead of 3%
  • Drawdown controls: auto-pause at 2% daily NAV
  • Full audit trail: every trade logged with entry/stop/target/outcome
  • Auto-observation logging: losses and SL hits automatically appended to observations.md for strategy learning
  • Self-improvement loop: lessons captured after each loss

Usage

Use hft-paper-trader to run TA on BTC and place a paper trade

Use hft-paper-trader to check portfolio performance

Use hft-paper-trader to scan the watchlist and trade all signals

Use hft-paper-trader to check today's observations and lessons

Regime Filter Logic

Entries are only allowed when BOTH regimes are bullish:

  • Fast (15m): EMA8 > EMA21
  • Macro (4h): EMA20 > EMA50

This gates out counter-trend entries that otherwise pass signal scoring. When either regime is bearish, new positions are blocked regardless of score.

Stop-Loss Placement (Fixed v1.1.0)

// CORRECT — caps SL at 3% below entry
stopLoss = entry * (1 - MAX_RISK);   // Math.max not used here — direct cap

// Bug in v1.0.0 — Math.min let SL run to 5-11%
// Fix: use direct percentage cap on entry price, not min of wick distance

Watchlist

BTC ETH SOL XRP TRX DOGE ADA AVAX BNB LINK LTC SUI ARB OP NEAR DOT ATOM UNI MATIC

File Layout

trading/
  paper-dashboard/portfolio.json   ← live portfolio state
  journal.json                     ← full trade ledger
  observations.md                  ← auto-logged trade lessons

Performance

Starting capital: $1,000. Runs hourly (XX:01 UTC). Max 5 concurrent positions at 10% each.

Comments

Loading comments...