← Back to Skills Marketplace
341
Downloads
1
Stars
2
Active Installs
3
Versions
Install in OpenClaw
/install tinkclaw
Description
Financial market intelligence from TinkClaw. Real-time AI trading signals (BUY/SELL/HOLD), market regime detection, Signal Market bot competition with SHA-25...
Usage Guidance
This skill appears to do what it says (fetch market signals from TinkClaw) and asks for a TinkClaw API key — that is reasonable. However: (1) the registry metadata does not list the env vars/binaries the SKILL.md and script require; verify the package metadata before installing. (2) The helper script reads TINKCLAW_API_URL (defaulting to tinkclaw.com) — do not set this to an untrusted host, because the agent will send your API key to whatever domain is configured. (3) The SKILL.md references a MARKET key, but the script doesn't use it for authenticated market endpoints (bug/inconsistency). Before installing: confirm the skill's origin (tinkclaw.com/docs), verify the creator, and prefer creating a dedicated API key with minimal privileges. If you proceed, do not reuse the same API key elsewhere; consider rate limits and that the skill will make outbound network calls to the TinkClaw domain. If you need higher assurance, ask the publisher to (a) fix registry metadata so required env vars and python3 are declared, (b) document or remove the TINKCLAW_API_URL override, and (c) ensure MARKET_KEY is properly used for /market endpoints.
Capability Analysis
Type: OpenClaw Skill
Name: tinkclaw
Version: 1.2.0
The tinkclaw skill is a financial market intelligence tool that provides trading signals, market regime detection, and AI-driven analysis via the TinkClaw API. The Python helper script (scripts/tinkclaw.py) is well-structured, using standard libraries to perform authenticated requests to the documented endpoints at tinkclaw.com. There is no evidence of data exfiltration, malicious execution, obfuscation, or harmful prompt injection in the SKILL.md instructions.
Capability Assessment
Purpose & Capability
The skill's name/description (real-time trading signals, regime detection, Signal Market) align with the included helper script and API reference. Requiring a TinkClaw API key (sk-tc-...) is coherent for this purpose. However, the registry metadata provided to OpenClaw lists no required env vars or binaries while SKILL.md and the script require python3 and a TINKCLAW_API_KEY — a metadata mismatch that should be corrected.
Instruction Scope
SKILL.md instructs the agent to call the TinkClaw API and to set TINKCLAW_API_KEY (and optionally TINKCLAW_MARKET_KEY). The helper script performs only HTTP requests to API endpoints under the configured API_BASE and prints JSON — it does not access arbitrary local files. Concerns: (1) the script reads TINKCLAW_API_URL (API_BASE) but SKILL.md does not document this env var; an attacker-controlled API_BASE could redirect all requests to an arbitrary host. (2) SKILL.md suggests a MARKET key, but the code never uses MARKET_KEY when calling /market endpoints (implementation bug), so instructions and code disagree.
Install Mechanism
No install spec; the skill is instruction + a small helper script. There are no downloaded archives or external installers in the package, so nothing is written to disk beyond the included files at install time.
Credentials
Requesting a TINKCLAW_API_KEY (and optionally a TINKCLAW_MARKET_KEY) is appropriate for this service. But the registry metadata omitted these required env vars and binaries, creating a mismatch. Additionally, the script supports TINKCLAW_API_URL (overriding the base URL) but this env var is undocumented — that increases risk if an attacker can set it. The skill will transmit whatever API key is present in the Authorization header to the configured API endpoint, so keys should be treated as sensitive.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and does not require system config paths or elevated privileges. Autonomous invocation is allowed (default) but that's expected for normal skills.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install tinkclaw - After installation, invoke the skill by name or use
/tinkclaw - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.2.0
Signal Market: leaderboard, challenge, verify, feed commands. Full 21-endpoint API reference. NemoClaw spec compliance (version, homepage, primaryEnv, requires.env).
v1.1.0
62 symbols (up from 33), combo workflows (morning brief, deep dive, alpha scan, portfolio risk check), intent mapping, pre-action checklists, regime reference table, security philosophy, prompt injection guards, data integrity constraints
v1.0.0
Initial release — AI agent training ground for financial markets.
Metadata
Frequently Asked Questions
What is TinkClaw?
Financial market intelligence from TinkClaw. Real-time AI trading signals (BUY/SELL/HOLD), market regime detection, Signal Market bot competition with SHA-25... It is an AI Agent Skill for Claude Code / OpenClaw, with 341 downloads so far.
How do I install TinkClaw?
Run "/install tinkclaw" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is TinkClaw free?
Yes, TinkClaw is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does TinkClaw support?
TinkClaw is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created TinkClaw?
It is built and maintained by dieub (@dieub); the current version is v1.2.0.
More Skills