Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Agent Trading Bot
v1.0.0AI-powered trading bot framework for OpenClaw. Connects to crypto exchanges (Binance, Hyperliquid, Bluefin) and prediction markets (Polymarket, Kalshi) via A...
⭐ 0· 27·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name/description match the code and SKILL.md: it is a trading bot that talks to exchanges and provides strategies and risk controls. However, the registry metadata declares no required environment variables or config paths while SKILL.md and the code explicitly require exchange API keys (e.g., BINANCE_API_KEY/BINANCE_API_SECRET) and read/write risk/config and log files under ~/.openclaw. That mismatch is incoherent and should have been declared.
Instruction Scope
SKILL.md and the script keep scope to trading-related actions: fetching prices/klines, computing indicators, paper/live trade execution, backtests, and managing a kill-switch. The instructions and code read/write files in ~/.openclaw (trading-config.json, workspace/memory logs and paper portfolio) and make network calls to exchange APIs — all expected for a trading bot. No evidence in the visible files of unrelated data collection or external exfiltration, but the skill logs decisions and persists trade/log data locally which users should be aware of.
Install Mechanism
There is no install specification (instruction-only with included script files). No downloads or archive extraction are requested, so nothing extra is written to disk beyond the script's normal runtime behavior (it will create ~/.openclaw paths).
Credentials
The code and SKILL.md require exchange API credentials (BINANCE_API_KEY/BINANCE_API_SECRET and mentions Hyperliquid keys) but the registry lists no required env vars or primary credential — an inconsistency. The requested secrets themselves are proportional for a trading bot, but registry metadata omission is misleading. Also the skill will need API keys with trading permissions to perform live trades; users should limit key scopes (disable withdrawals) and prefer testnet keys for testing.
Persistence & Privilege
The skill does not request 'always' or other broad platform privileges. It will persist configuration, logs, and a paper-portfolio under the user's home (~/.openclaw), which is reasonable for a bot but means state and logs are stored locally. The skill does not appear to modify other skills or global agent settings.
What to consider before installing
This package largely behaves like a trading bot, but it has important metadata mismatches you should not ignore: the registry declares no required env vars while the SKILL.md and code clearly expect exchange API keys and write config/log files under ~/.openclaw. Before using with real funds: 1) Review the full script (including the truncated parts) to confirm there are no hidden endpoints or surprising behavior. 2) Use API keys with the minimum permissions required (disable withdrawals, restrict IPs if possible), or use exchange testnet keys first. 3) Test thoroughly in paper mode only and validate the kill-switch works. 4) Inspect/backup or sandbox the ~/.openclaw directory the skill will create. 5) Ask the publisher to update registry metadata to declare required env vars and config paths — the current omission is a red flag. If you cannot audit the remaining code, avoid giving it live-trading credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk972mnqp1ay4rsj2ff37cy350h848h76
License
MIT-0
Free to use, modify, and redistribute. No attribution required.