Orderly Sdk Trading Workflows

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using these workflows with a real wallet could authorize trading-related account actions.

Why it was flagged

The workflow depends on authenticated wallet/account access, which is sensitive financial authority, but it is disclosed and expected for a DEX trading guide.

Skill content
- Wallet connection configured
- Account authenticated
Recommendation

Use only with wallets and accounts you intend to connect, verify requested wallet permissions, and test with small amounts or a test environment first.

What this means

Incorrect implementation or careless use could approve token spending, deposit funds, or place trades unexpectedly.

Why it was flagged

The examples show token approval/deposit and order-submission API calls. These are high-impact financial mutations, but they are central to the stated trading workflow and appear as user-triggered UI actions.

Skill content
await approve(); ... const result = await deposit(); ... const [submitOrder] = useMutation('/v1/order');
Recommendation

Add explicit confirmations, validation of amount/symbol/side, spending limits, cancellation paths, and clear user review before deposits, approvals, withdrawals, or order placement.

NoteMedium Confidence
ASI10: Rogue Agents
What this means

A bot built from these workflows could trade repeatedly without per-order user review if implemented that way.

Why it was flagged

The skill lists automated trading bots as a use case. The artifacts do not include background bot code, but autonomous trading is a sensitive deployment pattern.

Skill content
- Creating automated trading bots
Recommendation

If building automation, require explicit strategy limits, maximum order sizes, stop-loss controls, monitoring, audit logs, and a manual kill switch.