Kraken Exchange

Interact with the Kraken cryptocurrency exchange — spot + futures, REST + WebSocket. Use when: (1) checking crypto prices or market data, (2) viewing account...

This skill is internally consistent and appears to do what it claims, but you should: (1) only install or run it if you trust the tentactl binary/repo (inspect source or use official GitHub Releases), since the wrapper delegates all action to that binary; (2) prefer creating least-privilege Kraken API keys (read-only for queries, narrow trading perms only when needed) and keep them in a secure vault; (3) be aware the setup script can read from your local 1Password CLI (it lists item titles and can reveal fields) — run it only on machines you control; (4) test trading actions with validate:true and explicit user confirmation (the SKILL.md recommends this); and (5) if you need higher assurance, review tentactl's source or build the binary locally rather than installing an unsigned release.

Type: OpenClaw Skill Name: tentactl Version: 0.3.2 This skill is classified as suspicious due to its inherent high-risk capabilities, including real-money trading, fund transfers, and withdrawals on a cryptocurrency exchange, as well as its method of installing and handling API keys. While the `SKILL.md` includes explicit 'Safety Rules' to mitigate prompt injection and ensure user confirmation for sensitive actions, the `cargo install tentactl` command in `SKILL.md` and `scripts/kraken.sh` represents a supply chain risk, as it executes an external binary (`tentactl`) which, if compromised, could lead to arbitrary code execution. Additionally, `scripts/setup-keys.sh` handles sensitive API keys, storing them in `~/.tentactl.env` and interacting with the 1Password CLI, which are sensitive operations that, while seemingly legitimate for setup, contribute to the overall risk profile.