Weex Trading
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This is an instruction-only trading guide for a Telegram bot that mostly matches its stated purpose, but it contains ambiguous and contradictory guidance (local REST API, premium payment, claim of 'no bot fees') and instructs users to transmit API keys to a third-party bot — proceed with caution.
This document appears to be a user guide for trading through a third-party Telegram bot and the Weex API, but it contains ambiguous and sensitive instructions. Before using or following it: - Do not send full API keys with withdrawal permission; create API keys limited to spot trading only and with IP restrictions if available. - Treat the Telegram bot as a third-party service — verify its authenticity (official links, operator identity, open-source code or audits) before sending credentials. Telegram DMs may be stored on the provider side. - Be wary of the 'local REST API on port 8960' instruction — unless you control and run that bot locally, calling localhost is unlikely to reach the remote service and could lead an agent to probe local services. - Resolve inconsistencies (the guide claims 'no additional bot fees' but also a 0.1 TON premium for grid trading). Ask the skill author/operator to explain the payment flow and to provide evidence of secure key handling (e.g., open-source bot code, encryption details, privacy policy). - Consider performing trades via your own code using a restricted API key rather than handing secrets to a third-party bot. If you must use the bot, keep funds small and monitor activity closely.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.