← Back to Skills Marketplace
693
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install tradr
Description
Onchain trade execution engine. Feed a CA + score, get full trade lifecycle — sized entry, mode-based exits, on-chain verification, and trade logging. Requires Bankr skill.
Usage Guidance
What to check before installing and running tradr:
- Trust boundary with Bankr: tradr delegates all on-chain execution to the Bankr skill via the configured bankr.sh. Review the bankr.sh script and Bankr skill config (API key location and behavior). This skill sets BANKR_ALLOW_TRADE / BANKR_ALLOW_SELL in the child process environment to bypass Bankr trade guards — ensure bankr.sh enforces authentication/authorization appropriately.
- Install as a user service first: setup.sh writes a systemd unit and will try to put it in /etc/systemd/system (root). Prefer ./scripts/setup.sh --user to install under your user if you want lower privilege and to test behavior.
- Protect notification secrets: notify-telegram.sh sources ~/.env.secrets or a local .env.secrets file for TELEGRAM_* tokens. If you use notifications, store those secrets with strict filesystem permissions and review the script.
- Wallet private keys: tradr claims not to touch private keys; it relies on Bankr to perform trades. Do not put private keys into tradr config.json; ensure Bankr's secret handling is secure.
- Review config.json and RPC endpoints: ensure rpc_urls, wallets, and token_gate settings are correct. Default token_gate values could lock you out if enabled unintentionally.
- Test offline/sandbox: run scripts/test-tradr.py and exercise tradr-enter.py against a dry-run or a non-production configuration before enabling the systemd service.
- Audit filesystem and permissions: tradr writes workspace files (positions, trade log). Confirm their locations and permission expectations to avoid exposing sensitive data.
If you are comfortable with these points and trust the Bankr skill (or have audited bankr.sh), tradr appears coherent for its stated purpose. If you cannot audit Bankr or do not want an autonomous systemd service that can trigger trades, do not enable the service system-wide and avoid populating secrets/configs until you have reviewed the code.
Capability Analysis
Type: OpenClaw Skill
Name: tradr
Version: 1.0.0
The skill is classified as suspicious due to several high-risk behaviors, primarily the potential for privilege escalation and risky inter-skill communication. The `scripts/setup.sh` script installs `scripts/exit-manager.py` as a systemd service, which can be configured to run with root privileges (`sudo systemctl start`). This significantly increases the impact of any potential vulnerability within `exit-manager.py`. Furthermore, both `scripts/tradr-enter.py` and `scripts/exit-manager.py` execute the `bankr.sh` dependency with environment variables `BANKR_ALLOW_TRADE=1` and `BANKR_ALLOW_SELL=1`, which bypass internal guards in the `bankr` skill. While intended for mechanical pipeline operation, this design choice could be a vulnerability if `bankr.sh` expects more stringent checks from its callers. Finally, `scripts/notify-telegram.sh` (called by the main scripts) exfiltrates detailed trade information (buys, sells, P&L, errors) to Telegram, loading API tokens from `.env.secrets`. While this is a stated feature for notifications, it represents external data transmission of operational data.
Capability Assessment
Purpose & Capability
The skill claims to be an on-chain execution engine and explicitly depends on the Bankr skill; the code calls a bankr.sh script, queries on-chain RPCs and DexScreener, reads/writes position and trade-log files, and exposes an adapter interface. Nothing requested or installed is out of scope for an execution engine.
Instruction Scope
SKILL.md instructs running setup.sh, editing config.json (wallets, modes), enabling a systemd exit-manager, and feeding tradr-enter.py with CA+score. The runtime scripts read local config, positions/trade-log files, query public RPC endpoints and DexScreener, and call the bankr.sh helper. The notify hook sources a local .env.secrets file if present for Telegram tokens — this is expected for notifications but is not declared in the top-level metadata. The docs claim 'tradr never touches your private keys' — the code does not read private keys but delegates execution to Bankr (so trust in Bankr is required).
Install Mechanism
There is no registry install spec; this is an instruction+script bundle. setup.sh creates configuration, workspace directories, makes scripts executable, and writes/enables a systemd unit (to /etc/systemd/system by default) or a user service when --user is passed. No remote downloads or obscure URLs are used. Because setup can write a system service, it may require root privileges when installing system-wide.
Credentials
The skill declares no required environment variables, which is broadly correct, but the code will read a few environment values if present: SOL_WALLET_ADDRESS and EVM_WALLET_ADDRESS (fallbacks for wallet configuration), and the notify hook expects TELEGRAM_* variables if you use it (loaded from ~/.env.secrets or a skill-local file). The exit and entry scripts set BANKR_ALLOW_TRADE / BANKR_ALLOW_SELL in the subprocess environment to bypass Bankr trade guards — this is functional for automation but is effectively granting the Bankr helper permission to trade without additional interactive confirmation.
Persistence & Privilege
tradr installs and enables a persistent systemd service (exit-manager) by default. always:false (not force-included) and model invocation are normal. The service will autonomously poll prices and call Bankr to execute sells/buys. That autonomy is expected, but because the code sets env flags to bypass Bankr's trade guard, you should only enable the service if you trust the Bankr script and the configuration.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install tradr - After installation, invoke the skill by name or use
/tradr - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
v1.0 — position lifecycle management for bankr agents
Metadata
Frequently Asked Questions
What is tradr?
Onchain trade execution engine. Feed a CA + score, get full trade lifecycle — sized entry, mode-based exits, on-chain verification, and trade logging. Requires Bankr skill. It is an AI Agent Skill for Claude Code / OpenClaw, with 693 downloads so far.
How do I install tradr?
Run "/install tradr" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is tradr free?
Yes, tradr is completely free (open-source). You can download, install and use it at no cost.
Which platforms does tradr support?
tradr is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created tradr?
It is built and maintained by riskanon (@riskanon); the current version is v1.0.0.
More Skills