Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill is a WebSocket trade client (listings, bids, negotiations) which aligns with the name/description. It declares HUB_URL as a required env var in SKILL.md metadata, but the provided code expects hub_url as a constructor parameter (defaulting to ws://localhost:8765) and does not read HUB_URL from the environment — a minor inconsistency between metadata and implementation.
Instruction Scope
SKILL.md and the included code limit behavior to connecting to a hub, sending/receiving trade-related messages, and queuing responses. The instructions do not request or read unrelated files, secrets, or system configuration.
Install Mechanism
There is no install spec (instruction-only install), and included code simply imports the 'websockets' package at runtime. No downloads from arbitrary URLs or extract operations are present.
Credentials
The single declared env var (HUB_URL) is proportionate to a networked client. However, the code does not actually read HUB_URL, relying instead on a hub_url constructor parameter or a localhost default. The skill does not request tokens/keys or other credentials.
Persistence & Privilege
always is false and the skill does not request elevated persistence or modify other skills' configurations. Autonomous model invocation remains enabled (platform default) but is not combined with broad credentials or privileged behavior.
Assessment
This skill appears to do what it says: a WebSocket-based trade client requiring Python and the 'websockets' package. Before installing, verify where your agent will get the hub URL (SKILL.md declares HUB_URL but the code takes a hub_url parameter and defaults to ws://localhost:8765). Ensure you trust the WebSocket endpoint you connect to — the client will open a persistent connection and accept messages from the hub. Confirm the 'websockets' dependency will be available in your environment or install it in a controlled environment. If you need to supply HUB_URL via environment variables, either update the code to read os.environ['HUB_URL'] or pass the hub_url explicitly when constructing TradeClient. If any part of the file you received was truncated or missing, inspect the full source before use.Like a lobster shell, security has layers — review code before you run it.
latestvk97c3hesvzmfanzhrhnwrnr9w184g7j8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspython3
EnvHUB_URL