Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Nautilus Trader
v1.0.0How to use the NautilusTrader algorithmic trading platform for data conversion, strategy development, backtesting, paper trading (sandbox), and live trading....
⭐ 0· 38·0 current·0 all-time
byRicky@tujinsama
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (NautilusTrader usage: data conversion, backtesting, sandbox/live trading) align with the instructions. The SKILL.md consistently focuses on installing and using NautilusTrader and references the correct per-feature documentation (backtesting, data conversion, live/paper trading, strategy development).
Instruction Scope
Instructions tell the agent to inspect the user's workspace (ls pyproject.toml and nautilus_trader/__init__.py), clone the Nautilus repo from GitHub if missing, and run build/setup commands. These actions are coherent with setting up this project. The skill also references many exchange-specific environment variables (BINANCE_API_KEY, BYBIT_API_KEY, IB gateway config, etc.) which are appropriate for the live-trading features but are sensitive — the skill does not attempt to exfiltrate them, but it does instruct the user to set them for live connections. Overall scope stays within the trading domain.
Install Mechanism
There is no registry install spec, but the runtime instructions include multiple network-based installs: git clone from GitHub (reasonable), rustup installation via curl | sh (common but executes remote script), and an installer fetched from https://astral.sh/uv/install.sh piped to sh (a third-party domain that is not a canonical, widely-audited package host). The curl | sh pattern and an unverified installer URL are high-risk because they execute remote code on the user's machine; this is disproportionate to an instruction-only skill's least-privilege surface and should be reviewed manually before running.
Credentials
The skill does not declare required env vars in the registry, but the documentation explains many environment variables for exchange adapters (BINANCE_*, BYBIT_*, OKX_*, DATABENTO, IB gateway host/ports, etc.). Those variables are expected and proportionate to live trading. Because the skill is instruction-only, it doesn't request credentials itself, but users following the guide will need to provision sensitive API keys — they should understand the risks of granting those keys to any code. The SKILL.md also recommends setting build-related env vars (PYO3_PYTHON, LD_LIBRARY_PATH) which are justified for source builds.
Persistence & Privilege
always is false and the skill is instruction-only with no install manifest that would persist components into the agent environment. It does direct cloning and local builds when asked, but it does not request permanent skill-level privileges or attempt to modify other skills or system-wide agent settings.
What to consider before installing
This skill is a thorough how-to for NautilusTrader and largely matches its stated purpose, but it instructs you to run network-based installers and build steps that execute code from the internet (e.g., rustup via curl | sh and https://astral.sh/uv/install.sh piped to sh). Before running any commands suggested here: 1) Inspect the remote installer scripts (don't blindly pipe to sh). 2) Prefer official, well-known installers or package managers where possible. 3) Clone only the repository you trust (check the GitHub org and repo integrity). 4) Use testnet/sandbox modes and least-privilege API keys when trying out live adapters; never use production exchange keys in an untrusted environment. 5) If you're unsure about the astral.sh 'uv' installer, skip it and use a standard virtualenv/venv or pipx alternative. If you want a safer recommendation, I can: (a) show the exact commands to inspect the remote scripts before running them, (b) propose an install flow avoiding curl|sh, or (c) summarize which environment variables are required for sandbox vs production and how to scope API keys.Like a lobster shell, security has layers — review code before you run it.
latestvk97a3y1kerkv9sygphm2tqhhqs83zrc1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.