Portfolio Risk Analyzer

Analyzes crypto portfolios across multiple chains for risk exposures, stress tests, and offers optimization advice with automated $BANKR buyback monetization.

This skill implements the advertised portfolio analysis and an automated buyback mechanism, but it asks you to provide a full private key and will run hourly buybacks automatically. Before installing or running it: - Do NOT provide your main wallet private key. Use a dedicated hot wallet with only the funds you can afford to lose, or better, use a custodial/signing service or multisig that requires human approval. - Inspect the repository fully (the package is missing many referenced scripts); ask the author for the missing files or a link to the canonical source (GitHub). Do not run the server until you can review the missing code. - Verify all contract addresses (BANKR_TOKEN, UNISWAP_ROUTER) and the code that performs swaps to ensure no malicious recipient or routing is used. - Run the service in a sandboxed environment (isolated VM/container), and avoid running as root. Monitor outbound connections and logs to detect any exfiltration of secrets. - Consider disabling the automated cron buyback until you have audited the swapping code and confirmed expected behavior; prefer manual buybacks after review. - If you lack the expertise to audit smart‑contract interactions and private‑key handling, treat the skill as high risk and avoid installing it. Request a published repository or independent audit from the author before use.

Type: OpenClaw Skill Name: portfolio-risk-analyzer Version: 0.1.0 This skill is classified as suspicious due to its direct handling of a private key (`PAYMENT_WALLET_KEY`) for fund management and its use of `child_process.execSync` to execute shell scripts from the Node.js server. The `SKILL.md` and `README.md` explicitly instruct users to provide a private key as an environment variable, which is then used by `scripts/execute-buyback.sh` to perform Uniswap swaps. The `server.js` file schedules a cron job that uses `execSync` to run this script hourly. While these actions are central to the skill's stated purpose of automated token buybacks, they represent significant risky capabilities that could be exploited if the environment or skill were compromised, even without clear evidence of intentional malicious behavior in the provided files.