Trading Assistant Core
v4.0.0Market data analysis toolkit with technical indicators and portfolio tracking. Educational use only.
⭐ 0· 38·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (market data, indicators, portfolio tracking) align with what is requested: python/pip and API keys for Twelve Data and Alpha Vantage. Primary credential (TWELVE_DATA_API_KEY) is appropriate. Required binaries and declared env vars are directly relevant to the stated functionality.
Instruction Scope
SKILL.md instructs the agent to install dependencies, export the two API keys, and run the Python scripts. The files shown perform read-only data fetches (urllib/requests), indicator calculations, portfolio bookkeeping (local JSON files), and logging. SKILL.md's claim of 'no subprocess, no shell, no eval/exec' appears accurate in the reviewed files. The agent is instructed only to use the declared API keys and local files; there is no broad or vague permissioning in the instructions.
Install Mechanism
No external binary download/install spec in the registry entry. The repository contains Python modules and a requirements.txt; installation is via pip -r requirements.txt as documented in SKILL.md. This is a common, low-risk install mechanism — but you should review requirements.txt before installing to ensure there are no unexpected third-party packages.
Credentials
Only two API keys are required (TWELVE_DATA_API_KEY, ALPHA_VANTAGE_API_KEY), which match the data sources referenced in code and README. The code reads TRADING_ASSISTANT_LANG optionally (i18n), and the modules read/write local JSON files for persistence — no unrelated secrets or cloud credentials are requested. No evidence that environment variables beyond those declared are accessed in the inspected files.
Persistence & Privilege
The skill does create and write local files/directories (data/, logs/, portfolio/holdings.json, accuracy_log.json). always:false and normal model invocation settings (autonomy allowed) are used. Writing local JSON logs/config is expected for this app, but you should be aware it will persist portfolio/accuracy data in the skill's directory. There is no indication it modifies other skills or system-wide agent config.
Assessment
This package appears internally consistent for an educational trading-analysis tool, but before installing or running it: 1) Inspect requirements.txt and the remaining (omitted) Python files (trading_signals.py, support_resistance.py, any notification modules) for network calls, webhooks, or hardcoded remote endpoints (Feishu/DingTalk/email integrations are mentioned in README). 2) Run it in an isolated environment/container and only provide the minimal API keys needed (rotate keys after testing if concerned). 3) Be aware the tool will create/write local files (data/, logs/, portfolio/holdings.json, accuracy_log.json); if you have sensitive data in your environment, avoid mounting sensitive directories. 4) Do not supply brokerage credentials — this skill claims 'no trade execution' and there is no declared brokerage credential requirement; supplying broker keys would be unnecessary and risky. 5) If you plan to trust outputs for real trading, validate indicator logic and test thoroughly; the repository is labelled educational and 'not financial advice.' Finally, if you want higher assurance, provide the omitted source files (or examine them yourself) so they can be checked for any outbound notification code or unexpected behavior — I rated confidence medium because a few files were truncated/omitted in the listing.Like a lobster shell, security has layers — review code before you run it.
latestvk974aftqwxemntd9ec6fnt8b15843tmj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📊 Clawdis
Binspython3, pip
EnvTWELVE_DATA_API_KEY, ALPHA_VANTAGE_API_KEY
Primary envTWELVE_DATA_API_KEY
