Security checks across malware telemetry and agentic risk
This appears to be a real TradingFlow crypto automation skill, but it gives an agent high-impact trading, secret, and webhook authority with controls users should review carefully.
Install only if you intentionally want an agent to create and deploy crypto trading bots, manage TradingFlow secrets, and prepare or automate vault operations. Use least-privilege API keys, confirm the API base URL is HTTPS and trusted, store credentials only as secret entries, avoid unauthenticated webhooks for any process that can trade, start with tiny spending limits, and require explicit confirmation before deployments, webhook creation, secret changes, or vault permission changes.
External services send POST requests to the `inboundUrl`. No authentication required.
```bash
curl -X POST https://api.tradingflow.fun/api/v1/webhook/inbound/tok_xyz789 \
-H "Content-Type: application/json" \
-d '{"symbol": "BTCUSDT", "price": 42000, "signal": "buy"}'
```[ -z "$NAME" ] || [ -z "$CONTENT" ] && { echo "Usage: create-strategy.sh <name> [language] [chain] <content>"; exit 1; }
curl -s -X POST "$TRADINGCLAW_BASE_URL/strategy" \
-H "Authorization: Bearer $TRADINGCLAW_API_KEY" \
-H "Content-Type: application/json" \
-d "$(jq -n \63/63 vendors flagged this skill as clean.