OpenMM Grid Trading

Create and manage grid trading strategies with OpenMM. Automated buy/sell around center price.

Before installing or providing credentials: (1) Only supply API keys for the exchange(s) you actually intend to use — do not populate all four keys unless you need them. (2) Create API keys with minimal permissions (enable trading, disable withdrawals) and, where available, restrict by IP. (3) Audit the npm package @3rd-eye-labs/openmm before installation: check its repository, publisher, package.json, and published code for unexpected behavior. (4) Run the tool in a sandboxed environment (container or VM) and test with --dry-run first. (5) If you cannot inspect the package or verify the publisher, treat the package as higher-risk and avoid giving long-lived credentials. Additional information that would raise confidence: the package's source repository, a verified publisher, or explicit docs saying only the key for the selected exchange is required and what permissions are needed.

Type: OpenClaw Skill Name: openmm-grid-trading Version: 0.1.0 The skill bundle appears benign, designed for automated grid trading using the `openmm` CLI tool. All instructions in `SKILL.md` are directly related to configuring and executing trading strategies, including installation of the `@3rd-eye-labs/openmm` package and usage of various `openmm` commands. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts to subvert the agent's intended behavior. While the `--grid-profile` parameter could theoretically be abused for local file inclusion if the agent or `openmm` tool lacks robust input validation, this represents a potential vulnerability in the broader system rather than malicious intent within the skill bundle itself.