Ai Skill
v1.0.0Enables AI to create and trade shares in prediction markets, query positions and history, and execute automated trading strategies.
⭐ 0· 34·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name, README, SKILL.md and code all describe prediction‑market operations (create market, buy/sell, positions, strategies). Requested dependencies (aiohttp, pandas, numpy) align with HTTP calls and strategy computation. Minor inconsistency: SKILL.md and README show environment variables (CLAWMARKETS_API_URL, CLAWMARKETS_API_KEY) but the code does not read environment variables automatically — it expects api_base_url and api_key to be passed to constructors or connect() calls.
Instruction Scope
SKILL.md instructions and examples stay within trading use: connecting to an API, creating markets, executing strategies. There are no instructions to read unrelated files, shell history, or to transmit data to unexpected endpoints. Example usage uses localhost by default; actual network calls go to the configured API base URL.
Install Mechanism
No install spec is present (instruction-only in registry), so nothing is downloaded or executed during install. The package includes Python source files; dependencies are standard PyPI libraries (aiohttp, websockets, pandas, numpy) referenced in docs. No suspicious external URLs or archive downloads in install.
Credentials
The skill does not declare required environment variables or credentials in the registry metadata. SKILL.md recommends optional CLAWMARKETS_API_URL and CLAWMARKETS_API_KEY, which are proportionate to a trading client — but the code doesn’t auto-read env vars, creating a minor mismatch between documentation and implementation. No unrelated or excessive credentials are requested.
Persistence & Privilege
Skill flags are default (always: false, disable-model-invocation: false). This means the agent could invoke the skill autonomously (platform default). Given the skill can execute trades, users should be aware of the financial risk of autonomous operation; however the skill does not request elevated system privileges or modify other skills.
Assessment
This skill appears to implement what it claims: a client for a ClawMarkets API plus strategy code. Before installing or enabling automatic invocation: 1) Confirm the API base URL you configure is a trusted endpoint (prefer HTTPS) — by default examples use http://localhost:8080. 2) Do not supply real trading API keys until you have tested in a sandbox; run the provided test script in a safe environment. 3) Note the docs mention CLAWMARKETS_API_* env vars but the code expects api_base_url/api_key parameters — either pass them explicitly or review/modify the code to read env vars if desired. 4) Because the agent can act autonomously and place trades, consider disabling autonomous invocation or adding limits/approval gates to prevent unintended financial operations. 5) If you need full assurance, review the remaining truncated parts of source for any network calls beyond the configured api_base_url and run the test suite locally.Like a lobster shell, security has layers — review code before you run it.
latestvk974cb7e960a2kaggya9262315843w4p
License
MIT-0
Free to use, modify, and redistribute. No attribution required.