Quant Trader

WarnAudited by ClawScan on May 18, 2026.

Overview

Quant Trader is coherent as a crypto-trading skill, but it needs review because it asks users to install unscanned external trading code and connect exchange API keys for real automated trades while the docs also describe the project as alpha.

Install only if you are comfortable reviewing the external GitHub project and dependencies yourself. Start with paper trading or testnet, never enable withdrawals on exchange API keys, use small limits, and require explicit confirmation before any live trade.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

High

#ASI03: Identity and Privilege Abuse

What this means

If configured with trading-enabled exchange keys, the system could place real cryptocurrency trades and cause financial loss.

Why it was flagged

The skill instructs use of exchange API credentials for real trading, which can authorize financial account actions; the artifacts do not show clear API-scope limits or safety boundaries for those credentials.

Skill content

export BINANCE_API_KEY="your-key"
export BINANCE_API_SECRET="your-secret"
...
paper=False,  # Real mode
api_key=os.getenv('BINANCE_API_KEY'),
api_secret=os.getenv('BINANCE_API_SECRET')

Recommendation

Use testnet or paper mode first, create exchange API keys with withdrawals disabled and the smallest necessary permissions, set strict trade limits, and require explicit human confirmation before any live trade.

Medium

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users would be trusting external, unreviewed code with market-data access, local execution, and potentially exchange API keys.

Why it was flagged

The executable trading system is fetched from an external repository and dependencies are installed outside the reviewed skill package; the provided scan had no code files from that repository to analyze.

Skill content

git clone https://github.com/ZhenRobotics/openclaw-quant.git ~/openclaw-quant
cd ~/openclaw-quant

# Install dependencies
pip install -r requirements.txt

Recommendation

Review the GitHub repository and dependency list before installing, pin to a known commit, use a virtual environment, and avoid giving the code live-trading credentials until audited.

Medium

#ASI09: Human-Agent Trust Exploitation

What this means

A user may overestimate the maturity or safety of a system that can affect real funds.

Why it was flagged

The documentation markets live-trading capability, but the roadmap says the current version is Alpha and places live trading and production readiness in future versions.

Skill content

专为加密货币市场设计的专业量化交易系统，支持回测、模拟盘、实盘交易... 版本 0.1.0（当前）- 基础回测引擎... 版本 0.3.0 - 实盘交易... 版本 1.0.0 - 生产就绪... 状态: 开发中（Alpha）

Recommendation

Treat the project as experimental unless the actual implementation proves otherwise; do not rely on it for live trading without independent testing and review.

Low

#ASI10: Rogue Agents

What this means

Once started, the bot may continue trading until stopped, so mistakes or bad strategies can compound over time.

Why it was flagged

The live-trading example starts an ongoing automated trading loop. This is purpose-aligned for a trading bot, but it is persistent behavior with real financial impact.

Skill content

live = LiveTrading(
    strategy=MAStrategy,
    exchange='binance',
    symbol='BTC/USDT',
    paper=False,  # Real mode
...
)

live.run()

Recommendation

Confirm how to stop the process, test the emergency-stop behavior, monitor early runs closely, and use paper mode before any persistent live session.