Back to skill
Skillv1.0.0
ClawScan security
Mock Trading · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 11, 2026, 7:59 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code and instructions match its stated purpose (paper crypto trading); it fetches prices from CoinGecko, updates a local portfolio file, and does not request secrets or unusual system access.
- Guidance
- This skill appears to do what it says: run a paper-trading tick using CoinGecko prices and update a local JSON portfolio. Before installing/running: 1) verify you have a suitable Python runtime and the 'requests' package (pip install requests) because the skill doesn't declare or install them; 2) run the included script in a sandbox or dedicated directory (it will write/overwrite the portfolio JSON you point it at); 3) note that SKILL.md's suggested command 'uv run' is unusual for a Python script—use 'python3 scripts/mock_bot.py --portfolio ./my_portfolio.json --asset bitcoin' or adapt as needed; 4) be aware the script makes outbound requests to api.coingecko.com (public API); if you have strict network policies, run it where outbound HTTP is allowed. If you need the agent to run continuously, scheduling the command is a user decision — the skill does not autonomously persist or exfiltrate data.
Review Dimensions
- Purpose & Capability
- noteThe skill's name/description (mock trading) lines up with the included code: fetching public prices from CoinGecko and updating a local portfolio. Minor mismatch: the SKILL.md recommends running the script with the command 'uv run', but the bundle contains a plain Python script (no install spec) and the skill does not declare the runtime (python) or the 'requests' dependency it uses.
- Instruction Scope
- okRuntime instructions are scoped to copying the provided portfolio template, running the bot tick, scheduling it if desired, and reading the local portfolio file for reports. The instructions do not request reading unrelated files, system credentials, or sending data to unexpected endpoints. Note: they instruct adding the command to a 'HEARTBEAT.md' for automation, which is a user-facing scheduling suggestion rather than hidden behavior.
- Install Mechanism
- noteThere is no install spec (instruction-only) and the code file is small and human-readable. The script requires Python and the 'requests' library but the skill does not declare these requirements or provide an installation step; users will need to ensure an appropriate Python runtime and requests are available.
- Credentials
- okThe skill requests no environment variables, no credentials, and no config paths. It makes outbound requests to the public CoinGecko API (no auth required), which is proportional to the stated purpose.
- Persistence & Privilege
- okThe skill is not marked always:true and does not attempt to modify other skills or global agent settings. Its only persistent action is writing/updating a local portfolio JSON file supplied or copied by the user.