← Back to Skills Marketplace
Questrade
by
Jose Herrera
· GitHub ↗
· v1.0.0
278
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install questrade
Description
Access Questrade brokerage accounts and Canadian/US market data for balances, positions, orders, executions, Level 1 quotes, historical candles, and symbol s...
Usage Guidance
This skill appears to implement the Questrade API correctly, but the registry metadata failed to declare the sensitive credentials it needs. Before installing: (1) only provide your Questrade refresh token if you trust the skill source — verify the owner and code. (2) Be aware the script will save rotated refresh tokens and an access-token cache to ~/.openclaw in plaintext; restrict those files' permissions (e.g., chmod 600) or keep them in a locked environment. (3) Prefer creating a read-only/token limited account if possible, and enable QUESTRADE_READ_ONLY to block orders. (4) Consider running the script in an isolated environment (container/VM) if you are unsure. (5) Ask the publisher to update the registry metadata to declare QUESTRADE_REFRESH_TOKEN as the primary credential and to document file-write behavior so automated systems can make an informed install decision.
Capability Analysis
Type: OpenClaw Skill
Name: questrade
Version: 1.0.0
The 'questrade' skill is a legitimate integration for the Questrade brokerage API. It implements standard OAuth 2.0 token rotation by reading and updating a local credentials file (~/.openclaw/credentials/questrade.json), which is necessary for Questrade's API requirements. The script (scripts/questrade_cli.py) includes safety guardrails such as a read-only mode and confirmation prompts for order placement, and all network traffic is directed to official Questrade domains (questrade.com).
Capability Assessment
Purpose & Capability
The skill name/description match the included code: it accesses Questrade account and market data. However the registry metadata declares no required environment variables or primary credential, while the SKILL.md and the script clearly require a Questrade refresh token (QUESTRADE_REFRESH_TOKEN) and optionally QUESTRADE_PRACTICE / QUESTRADE_READ_ONLY. That omission is an inconsistency — a credential is required for the stated purpose but not declared.
Instruction Scope
The runtime instructions and the Python script are focused on Questrade API calls only. They instruct users to provide a refresh token via env var or ~/.openclaw/credentials/questrade.json. The script reads/writes that credentials file and a token cache at ~/.openclaw/data/questrade-token-cache.json (it also updates the in-process env). These file reads/writes and network calls are within scope for this broker API skill, but the auto-saving of rotated refresh tokens to disk is a behavior users should be aware of.
Install Mechanism
This is an instruction-only skill with a small Python script and a requirements.txt (requests). No remote downloads, installers, or obscure third-party packages are used. Installing via pip install -r requirements.txt is sufficient and expected.
Credentials
The skill requires a sensitive OAuth refresh token and honors QUESTRADE_PRACTICE and QUESTRADE_READ_ONLY env vars, but the registry metadata lists no required env vars or primary credential. The script also persists rotated refresh tokens in plaintext under the user's home directory (~/.openclaw), which is reasonable functionally but increases local credential exposure. The combination (sensitive creds required but not declared) is disproportionate to how the registry advertises the skill.
Persistence & Privilege
The skill does persist state: it writes rotated refresh tokens and an access-token cache under ~/.openclaw. It does not request global privileges or always:true. Persisting the token and cache is functionally reasonable for an API client, but users should note files are created in their home directory and are stored in plaintext.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install questrade - After installation, invoke the skill by name or use
/questrade - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release
Metadata
Frequently Asked Questions
What is Questrade?
Access Questrade brokerage accounts and Canadian/US market data for balances, positions, orders, executions, Level 1 quotes, historical candles, and symbol s... It is an AI Agent Skill for Claude Code / OpenClaw, with 278 downloads so far.
How do I install Questrade?
Run "/install questrade" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Questrade free?
Yes, Questrade is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Questrade support?
Questrade is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Questrade?
It is built and maintained by Jose Herrera (@josemiguelherrera); the current version is v1.0.0.
More Skills