Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Trading Assistant Clean V2
v3.0.0安全的交易分析工具 - 技术指标、交易信号和仓位管理。只读市场数据，无交易执行，无需经纪凭证。
⭐ 0· 33·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The declared purpose is a read-only analysis tool that only calls Twelve Data and Alpha Vantage and does not execute trades. However the codebase includes live_trading_interface.py and CLI commands referring to a 'live' / 'live trading interface', as well as Docker instructions that mount a .env into /app/.env. The presence of a live trading module contradicts the stated 'no execution' promise. Additionally, a_stock_data.py calls Sina Finance endpoints (hq.sinajs.cn and money.finance.sina.com.cn), which are not listed in the SKILL.md 'only Twelve Data and Alpha Vantage' claim.
Instruction Scope
SKILL.md repeatedly asserts no runtime .env loading and only two environment variables are required, but README and other files provide Docker examples that mount .env files and mention optional notification integrations (Feishu, DingTalk, Email). Some modules (accuracy_tracker.py, data/alerts, logs) write files inside the project directory. The instructions are specific about setting TWELVE_DATA_API_KEY/ALPHA_VANTAGE_API_KEY, but runtime code and docs reference additional network endpoints and optional integrations that may require other credentials or webhooks not declared in requires.env.
Install Mechanism
No remote download/extract install is declared; dependencies are standard Python packages (requirements.txt). The skill appears to be source-based and installed via pip/installing requirements — no high-risk external installers or URL downloads were specified in the registry metadata or SKILL.md.
Credentials
Requires only TWELVE_DATA_API_KEY and ALPHA_VANTAGE_API_KEY which is reasonable for market-data functionality. However the codebase includes modules that suggest optional notifications and a live trading interface which likely need additional secrets (webhooks, broker API keys) but these are not declared. This mismatch between declared env requirements and apparent capabilities is suspicious: additional credentials may be read conditionally or expected in .env files or config, despite SKILL.md stating it removed load_dotenv().
Persistence & Privilege
The skill does not request always:true and does not appear to modify other skills or system-wide agent settings. It reads/writes files within its project directory (logs, accuracy_log.json, data/alerts), which is normal for a CLI tool.
What to consider before installing
Before installing or running this skill, review the following:
- Inspect live_trading_interface.py and config.py for any code that connects to broker APIs or performs order/POST operations. The presence of a 'live trading interface' contradicts the SKILL.md claim of no trade execution.
- Search the codebase for network calls (requests.post / urllib.request.urlopen) and examine target domains. a_stock_data.py calls Sina Finance endpoints (hq.sinajs.cn and money.finance.sina.com.cn) even though SKILL.md claims only Twelve Data and Alpha Vantage.
- Open .env.example and any config loading logic to confirm the skill truly does not auto-load .env files. README/Docker examples mount a .env into the container — if you use those instructions, ensure you only include keys you intend to expose.
- Audit notification modules (Feishu/DingTalk/Email) for undeclared env vars or webhook URLs. If you do not need notifications, remove or disable those modules.
- Run the tool in an isolated environment (container or VM) first, with minimal secrets set, and monitor outbound connections to ensure it only calls expected APIs.
- If you plan to provide broker credentials or enable 'live' features, only do so after manual code review and confirming explicit, declared env variables and secure handling of those credentials.
Given the mismatches between the advertised safety model and the repository contents, treat this skill as potentially risky until you confirm there is no hidden execution or undeclared credential usage.Like a lobster shell, security has layers — review code before you run it.
latestvk97bc8fse1pkwd21zsj26nf041843cwy
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📊 Clawdis
Binspython3, pip
EnvTWELVE_DATA_API_KEY, ALPHA_VANTAGE_API_KEY
Primary envTWELVE_DATA_API_KEY