Trading Brain

Load Travis's personal trading strategy and rules to guide aggressive trades, focusing on early-stage next-wave market opportunities and strict risk limits.

This skill reads and updates specific local scripts and files and expects brokerage data (Alpaca) even though it declares no credentials or installs. Before installing or enabling it: 1) Inspect the referenced files (~/clawd/integrations/serper/search.sh, ~/Documents/GitHub/trade-bot/config.yaml, ~/clawd/memory/trading/*) to see if they contain API keys or other secrets. 2) Do not grant filesystem or Alpaca API access to the agent until you verify those files and scripts are trustworthy. 3) Prefer explicit environment variables or an authorization prompt for any brokerage keys instead of implicit file access. 4) If you plan to let the agent execute trades, require explicit, human-confirmed approval for each order (no autonomous live trading) and test in a sandbox/demo account. 5) If you want to proceed, ask the skill author to (a) declare required credentials and integrations, (b) explain how Alpaca access is obtained and limited, and (c) remove or document any file reads so you can audit them. These steps reduce the risk of accidental secret exposure or unexpected trading actions.

Type: OpenClaw Skill Name: trading-brain Version: 1.0.0 The `SKILL.md` file instructs the AI agent to execute a shell script (`~/clawd/integrations/serper/search.sh`) with a dynamic 'query' parameter. This direct command execution instruction creates a significant shell injection vulnerability if the agent or the `search.sh` script does not properly sanitize the 'query' input, potentially leading to arbitrary command execution. While other file system operations are present, they appear to be for legitimate configuration and logging within the agent's operational directories, and there is no clear evidence of intentional malicious behavior like data exfiltration or persistence.