Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose (Futu paper trading) matches the included code and the use of futu-api/akshare. However the registry metadata declares no required environment variables or credentials while the SKILL.md and code clearly rely on environment variables (FUTU_TRADE_PWD, FUTU_HOST, FUTU_PORT, etc.). The skill's source/homepage is 'unknown', increasing risk that the package bundle may not be from a trusted origin.
Instruction Scope
SKILL.md instructs the agent to run the bundled Python script which will: create a virtual environment, pip install requirements, and re-exec itself. The instructions reference several environment variables and local FutuOpenD service access. The skill will access environment variables containing sensitive data (trade password, optional account/password). The runtime instructions will install and execute third-party packages (futu-api, akshare) which can perform network I/O beyond the local OpenD service.
Install Mechanism
There is no explicit install spec in the registry, but the bundled script auto-creates a .venv and runs pip install -r requirements.txt at runtime. This is a common pattern for Python tools but means arbitrary package code from PyPI will be fetched and executed on the host. The packages used (futu-api, akshare) are plausible for the stated purpose; the install is runtime and not pinned to exact versions.
Credentials
SKILL.md and the code require several environment variables (FUTU_TRADE_PWD mandatory for trading, FUTU_TRD_ENV, FUTU_HOST, FUTU_PORT, FUTU_ACCOUNT, FUTU_PASSWORD). The registry metadata, however, lists no required env vars or primary credential — an inconsistency. Requiring passwords via environment variables is sensitive and should be declared and justified in metadata. The skill does check and disallow REAL trading env, which is a mitigating control for intent but does not eliminate credential risk.
Persistence & Privilege
The skill does not request 'always: true' and does not appear to modify other skills or global agent configurations. Its persistence is limited to creating a .venv inside the skill directory and installing dependencies there. Autonomous invocation is allowed by default (normal), but that increases blast radius if the skill were malicious.
What to consider before installing
This skill will run code on your machine: it auto-creates a virtual environment and pip-installs futu-api and akshare, then contacts a local FutuOpenD service to query and place simulated trades. Before installing or enabling it, consider the following:
- Source & provenance: the skill's homepage/source is unknown. Prefer skills from a verified repository or author. Review the full xtrade_futu_skill.py source yourself (it is included) or run it in an isolated environment first.
- Credentials: it expects sensitive environment variables (FUTU_TRADE_PWD, FUTU_PASSWORD, FUTU_ACCOUNT). Do not set real account passwords in long-lived environment variables. Prefer temporary or limited-scope credentials and confirm FUTU_TRD_ENV is set to PAPER/SIMULATE.
- Runtime install: the script will pip install packages at runtime. That fetches and executes third-party code from PyPI; if you do not trust futu-api/akshare or want deterministic installs, inspect requirements and pin versions, or pre-create the venv yourself.
- Network behavior: besides communicating with the local FutuOpenD daemon, akshare may fetch data from public web sources. If you need to restrict outbound network access, run the skill in a sandbox with network policies.
- Testing: run the skill in a sandboxed VM or container first and verify it only talks to your local OpenD and expected external services. Check logs and network traffic.
- If you rely on the agent autonomously invoking this skill, remove autonomous privileges or monitor actions: automatic order placement can have costly consequences even in paper mode if misconfigured.
Given the metadata mismatch (no declared env vars) and unknown origin, proceed with caution — the behavior is coherent for a paper-trading tool but the missing declarations and runtime package installs elevate risk.Like a lobster shell, security has layers — review code before you run it.
latestvk97ax93vvmz69gr1bnr8nbg0z582evcr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
OSmacOS · Linux · Windows
Binspython3