Pendle PT Fixed-Yield Strategy
v1.0.2Pendle PT fixed-yield strategy for market scanning, ranking, position tracking, maturity monitoring, and execution planning. Prefer managed wallet execution...
⭐ 0· 25·0 current·0 all-time
by@moshu
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, SKILL.md, and the included scripts align: they scan Pendle APIs and ecosystem sources, rank markets, produce briefs/reports, and track positions. Required resources (none) are proportional to the stated purpose.
Instruction Scope
SKILL.md explicitly prefers managed-wallet execution (Privy) and manual execution fallbacks and forbids bundling secret-key signing; the runtime scripts are consistent with analysis/monitoring/execution-planning and do not perform signing or attempt to read secrets. Note: the SKILL.md asks the agent to prefer a 'privy' skill if present, but the repository's scripts themselves do not implement a direct Privy integration — that integration is expected to be provided by the host/agent environment.
Install Mechanism
No install spec is provided (instruction-only deployment), which reduces install risk. There are code files but no automated installer or external archive downloads; nothing writes outside the skill's directory except when agent/host runs scripts.
Credentials
The skill declares no required environment variables, credentials, or config paths. Scripts make outbound requests to Pendle and related public endpoints (api-v2.pendle.finance, indexer.euler.finance, api.morpho.org, raw.githubusercontent.com, pendle.finance), which is expected for market data collection and integration verification.
Persistence & Privilege
always:false and default model invocation are appropriate. The skill reads/writes its local data/positions.json and other data files under its own package; this is expected for position tracking. It does not request to modify other skills or global agent settings.
Assessment
This package appears coherent and limited to market research, ranking, and local position tracking. Before installing: (1) confirm your host/agent provides the managed-wallet (Privy) integration you expect if you want agentic execution — the package only recommends Privy but doesn't implement signing. (2) Review data/positions.json for any sensitive info before sharing; the skill will read/write it locally. (3) Expect outbound network calls to public Pendle and ecosystem endpoints for live data — run the skill in an environment you trust to permit those requests. (4) If you plan autonomous execution, ensure the managed wallet enforces policy limits and that no private keys are placed in plaintext under the skill directory. Overall, nothing in the bundle requests unrelated secrets or escalated privileges.Like a lobster shell, security has layers — review code before you run it.
latestvk97ejcnh4eyzyyfg6n8xa1g3w9847nc0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.