Bitstamp Trader
SuspiciousAudited by ClawScan on May 10, 2026.
Overview
This appears purpose-built for Bitstamp trading, but it can place real crypto orders and some safety controls rely on careful human/agent approval rather than fully enforced prompts.
Review carefully before installing because this skill can trade on a real Bitstamp account. Use a dedicated API key with no withdrawals, keep limits low, confirm every live order yourself, and avoid live mode until you have verified the dependency installation and local configuration.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A real Bitstamp order could be placed for smaller amounts if --live is used, even though the skill documentation says live trades should always get explicit confirmation.
The visible in-tool confirmation gate applies only to live trades at or above the configurable large-trade threshold. Lower-value live trades can continue after the --live flag without this script-level prompt, so accidental or autonomous invocation could still create real financial exposure.
if live and est_usd >= cfg["large_trade_threshold_usd"]:
...
confirm = input(" Type CONFIRM to proceed: ")Only allow live trading after a clear human confirmation, keep default limits low, and consider requiring an in-tool confirmation prompt for every live order regardless of size.
If the API key has excessive permissions or is exposed, someone could trade on the account, and possibly do more if withdrawals were enabled.
The skill requires Bitstamp API credentials for account and trading operations. The permission guidance is appropriate for the purpose, but these credentials still grant financial account access and should be tightly scoped.
export BITSTAMP_API_KEY="your-key" export BITSTAMP_API_SECRET="your-secret" ... create an API key with **Orders** permission only (NO Withdrawals). Enable **IP whitelisting**.
Use a dedicated Bitstamp API key with orders/trading only, no withdrawals, IP whitelisting, and low exchange-side limits where possible.
A bad or unexpected dependency version could affect a tool that has access to a trading account.
The script depends on ccxt and gives a manual unpinned pip install instruction, while the provided install spec declares no dependencies. This is expected for a CCXT-based trading CLI but leaves package version selection to the user.
print("ERROR: ccxt not installed. Run:")
print(f" source {SKILL_DIR}/.venv/bin/activate && pip install ccxt")Install dependencies from trusted sources, pin a known-good ccxt version, and review the environment before enabling live trading.
Local files may disclose trading history to anyone with access to the account, and changes to local config or kill-switch files can influence future trades.
The skill intentionally persists audit logs and control state that can reveal trading activity and affect future trading behavior.
Audit Trail — Every action logged to `~/.config/bitstamp-trader/audit.jsonl` ... The kill switch creates a lock file at `~/.config/bitstamp-trader/KILL_SWITCH`.
Keep the config directory private, avoid sharing audit logs, and review config or kill-switch state before live trading.