Alpaca Trading
v1.0.0Trade stocks and crypto via Alpaca API. Use for market data (quotes, bars, news), placing orders (market, limit, stop), checking positions, portfolio management, and account info. Supports both paper and live trading. Use when user asks about stock prices, wants to buy/sell securities, check portfolio, or manage trades.
⭐ 3· 1.9k·5 current·5 all-time
by@vamzi
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (Alpaca trading: quotes, orders, positions, streaming) align with the included CLI implementation. The code uses Alpaca endpoints and provides expected features (orders, checks, streaming, alerts).
Instruction Scope
SKILL.md and the CLI instruct only on trading-related actions and where credentials/alerts are stored (~/.openclaw/credentials/alpaca.json and ~/.openclaw/data/alpaca-alerts.json). There are no instructions to read unrelated system files or send data to unknown endpoints — network calls are to Alpaca.
Install Mechanism
There is no install spec even though the shipped script imports alpaca-py and will exit if it's not installed. The skill does not document installing dependencies in SKILL.md (the script prints a pip suggestion at runtime). Missing an explicit, trustworthy install mechanism and dependency declaration is a packaging/operational risk.
Credentials
SKILL.md requires ALPACA_API_KEY, ALPACA_SECRET_KEY and ALPACA_PAPER (or a credentials file), but the registry metadata lists no required environment variables / primary credential. The skill legitimately needs API credentials, but the registry omission is an incoherence that hides the need for sensitive keys.
Persistence & Privilege
The skill does not request always:true and does not modify other skills. It will store alerts and optionally a credentials file under the user's home directory (~/.openclaw). Note: autonomous invocation is enabled by default — for a trading skill this increases risk because it could place orders; ensure confirmations and prefer paper trading during testing.
What to consider before installing
This skill appears to implement a real Alpaca CLI, but several inconsistencies mean you should not install it blindly. Before installing: (1) Confirm the source/author (homepage unknown) and review the full script yourself. (2) Expect to provide sensitive Alpaca credentials (ALPACA_API_KEY and ALPACA_SECRET_KEY); do not store live keys until you trust the code. (3) The package lacks an install spec — install alpaca-py in a safe environment (virtualenv) and test with ALPACA_PAPER=true (paper trading) first. (4) Ask the publisher to update registry metadata to declare required env vars and dependency requirements. (5) Because the agent can invoke skills autonomously, consider disabling autonomous invocation or requiring explicit confirmation before any real trade (avoid using --force) until you fully trust the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk97a3fg7v2rmmc65kpczegbcw980rbqx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.