test

Create and manage AI-powered trading bots via natural language. Paper & live trading, portfolio monitoring, backtesting, stock quotes, and options chains.

This skill appears internally consistent for providing trading-bot functionality and only requests one API key (VIBETRADER_API_KEY). Before installing: 1) Verify you trust the external service and its MCP server URL (the skill sends commands/data there). 2) Keep the key scope-limited if possible and store it securely; the README suggests adding it to ~/.openclaw/openclaw.json which creates a persistent credential on disk. 3) Start in paper-trading mode and monitor actions closely before enabling live trading. 4) If you plan to allow autonomous actions, be aware the agent could execute trades using the provided API key — you may prefer to require explicit confirmation for trade-executing commands. If you want further assurance, ask the publisher for documentation on how brokerage credentials are handled (e.g., whether Alpaca credentials are kept only on the Vibetrader site and not stored by the skill).

Type: OpenClaw Skill Name: naif Version: 1.0.0 The skill bundle is classified as benign. All files consistently describe an AI-powered trading bot skill that connects to the VibeTrader service at `https://vibetrader-mcp-289016366682.us-central1.run.app/mcp`. It requires a user-provided `VIBETRADER_API_KEY` for authentication. The `SKILL.md` and other documentation clearly outline the skill's purpose, setup, and available tools, which are all aligned with managing trading bots and portfolios. There is no evidence of prompt injection attempts against the agent, unauthorized data exfiltration, malicious execution, persistence mechanisms, or obfuscation. The inherent risks are related to the domain of live trading, not the skill's malicious design.