Crypto Self-Learning

• Analyzed: May 12, 2026, 3:18 AM
• Findings: 0
• Version: 1.0.0
• Hash: 16ec1163f42df86f6acfffaaac6b9199fd3fbb5410a1cd9065deeeff08cb59bb
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: crypto-self-learning Version: 1.0.0 The OpenClaw skill 'crypto-self-learning' is designed for local crypto trade analysis and rule generation. All scripts (`analyze.py`, `generate_rules.py`, `log_trade.py`, `update_memory.py`) operate on local JSON files within the skill's `data` directory. The `SKILL.md` instructions and the `update_memory.py` script's modification of `MEMORY.md` are directly aligned with the stated purpose of updating the agent's learned rules, without any evidence of prompt injection, data exfiltration, remote execution, or other malicious behaviors. Required binaries (`jq`, `python3`) are standard and appropriate for the task.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI06: Memory and Context Poisoning

Note

What this means

Incorrect, stale, or overfit trade history could become persistent guidance and bias future crypto-trading recommendations.

Why it was flagged

The script can write generated trading rules into an existing agent memory file chosen by path, creating persistent context that future agent sessions may use.

Skill content

parser.add_argument("--memory-path", required=True, help="Path to MEMORY.md") ... with open(memory_path, "w") as f: f.write(new_content)

Recommendation

Use --dry-run first, review the generated rules and trade history, back up MEMORY.md, and only write to the intended memory file.

ASI04: Agentic Supply Chain Vulnerabilities

Note

What this means

The advertised weekly review command may fail, or a user might be tempted to obtain and run an unreviewed helper from elsewhere.

Why it was flagged

The documentation instructs users to run a weekly_review.py helper, but that file is not present in the supplied manifest or file contents.

Skill content

python3 {baseDir}/scripts/weekly_review.py

Recommendation

Do not run missing helper scripts from outside the package unless they are reviewed; the maintainer should include the file or remove the command.

ASI09: Human-Agent Trust Exploitation

Note

What this means

A user or agent may apply learned rules too rigidly and make poor trading decisions based on limited or non-representative data.

Why it was flagged

The wording encourages strong reliance on generated rules in a financially sensitive trading context.

Skill content

Trust the data - If data says avoid something, AVOID IT

Recommendation

Treat the output as journaling and analysis, not guaranteed financial advice; require human review before making trades.