TradingFlow — AI-Powered Intent Trading Across Crypto, Stocks & More

Create and manage crypto trading strategies, deploy automated trading bots, and control on-chain vaults on BSC, Aptos, and Solana. Use when the user wants to...

Key things to consider before installing or using this skill: - Metadata mismatch: The skill registry lists no required credentials, but the SKILL.md and scripts require TRADINGCLAW_API_KEY and TRADINGCLAW_BASE_URL. Ask the publisher why registry metadata omits these and insist they be declared. - Do not hand over private keys lightly: The skill's Mode 2 workflow asks you to generate and store an 'Oracle' private key (VAULT_ORACLE_KEY). Only do this if you fully trust the platform, have audited the service, and understand that this key can sign on-chain transactions (even if scoped by permissions). Prefer Mode 1 (manual approvals) whenever possible. - Start with least privilege: If you test the skill, create an API key with minimal scope, grant agent permissions = 1 (SWAP only), and set conservative token spending limits. Use testnet or a small amount first. - Verify endpoints & ownership: The SKILL.md uses tradingflow.fun and api.tradingflow.fun but the package source & homepage are listed as unknown/none. Confirm the service identity and ownership outside the skill (official website, GitHub org, independent reviews). Do not reuse high-privilege keys from other services. - Watch webhooks: The documentation shows inbound webhook URLs 'No authentication required'. If you use webhooks, require HMAC secrets or limit sources to trusted IPs to avoid unauthenticated triggers. - Validate contradictory instructions: The skill contains contradictory guidance around using GET /auth/me. Ask the maintainer to clarify the correct validation flow and update docs. - Operational hygiene: Avoid placing API keys or private keys in global shell profile files. Use ephemeral environment variables, scoped secrets storage, and rotate keys after testing. Monitor process logs and secret accesses, and revoke roles immediately if behavior is unexpected. If you cannot verify the publisher or fix the metadata inconsistencies, treat this skill as untrusted and do not provide real funds or private keys to it.

Type: OpenClaw Skill Name: tradingflow Version: 0.0.2 The 'tradingflow' skill bundle is a comprehensive integration for a crypto trading platform, providing tools for strategy management, automated bot deployment, and on-chain vault operations (BSC, Aptos, Solana). While it handles sensitive operations like private key management (Oracle keys) and fund transfers, it incorporates robust security controls including AES-256-GCM encryption for secrets, mandatory browser-based approval flows for transactions, and a 'R&D Mode' safety gate for high-risk configurations. The instructions in SKILL.md are well-aligned with the stated purpose and explicitly direct the agent to follow security best practices, such as avoiding the logging of secrets and ensuring user approval for all on-chain actions.