Use a Bash CLI to query Kraken Spot and Futures APIs, inspect account state, run guarded trading and funding actions, and work with Kraken websocket payloads...

This skill looks like a genuine Kraken CLI, but there are important mismatches you should clear up before installing or giving it real API secrets: - Confirm required secrets: The code needs KRAKEN_API_SECRET (and futures secrets) in addition to the declared KRAKEN_API_KEY; the registry metadata should be updated to list all required secret env vars. Do not provide real keys until you confirm which secrets are requested. - Confirm required binaries: The runtime validates node, base64, od and may require jq for certain output modes, but SKILL.md only lists bash, curl, openssl. Ensure your environment has the actual binaries the code checks for. - Missing artifacts: The manifest does not include the CLI entrypoint (bin/openclaw-kraken) nor the endpoints TSV files referenced by the code. Ask the publisher to provide the missing files or an updated package — otherwise the skill will fail or behave unexpectedly. - Network destinations: The code enforces use of configured base URLs for REST, but the websocket helper accepts arbitrary --url in examples. If you plan to allow autonomous invocation, restrict allowed destination URLs or audit any --url input to avoid connecting to untrusted endpoints. - Secrets handling: The skill claims to read secrets from environment only and to redact secrets from logs; the implementation contains explicit redaction and signing code, which looks consistent. Nevertheless, only provide secrets via OpenClaw secret refs (not plaintext) and test in simulated mode first (KRAKEN_SIMULATE=true) with non-production keys. If the publisher can update SKILL.md/registry metadata to list all required env vars and binaries and supply the missing CLI and endpoints files, this skill would become coherent and more trustworthy. Until then treat it as suspicious and avoid supplying production credentials or enabling autonomous runs.

Type: OpenClaw Skill Name: kraken-cli Version: 1.0.0 The bundle is a legitimate and well-structured integration for the Kraken cryptocurrency exchange. It includes robust security guardrails, such as automated secret redaction in logs (lib/kraken_redact.sh), strict validation of API paths and base URLs (lib/kraken_validate.sh), and mandatory confirmation flags for state-changing operations like trading or withdrawals. The instructions in SKILL.md explicitly reinforce security best practices for the AI agent, and no indicators of data exfiltration, obfuscation, or unauthorized remote execution were found.