Toobit Trading

Trade crypto on Toobit exchange via natural language. Spot & USDT-M futures trading, market data queries, wallet management. Use when user mentions Toobit, o...

This skill appears to be a legitimate Toobit API adapter, but the package metadata is missing declarations for the API key/secret and needed binaries (curl/openssl/awk). Before installing: (1) only provide API credentials with the minimal permissions required (create a key that disables withdrawals and restricts trading if you only need read or trade functions); (2) verify the skill owner/source (homepage is missing) and consider trusting only well-known authors; (3) confirm the agent actually prompts for and requires explicit, user-driven confirmation for any write or withdraw actions (don't rely solely on the SKILL.md wording); (4) prefer creating and using scoped keys or a read-only key for market queries; (5) treat environment variables with secrets carefully (set them in a secure location, avoid sharing them with untrusted agents). The main red flag is the metadata omission of sensitive env vars — that inconsistency is why this is suspicious rather than benign.

Type: OpenClaw Skill Name: toobit Version: 1.0.0 The skill bundle provides a legitimate interface for interacting with the Toobit cryptocurrency exchange. It includes comprehensive instructions for market data, trading, and account management, while explicitly defining safety protocols such as requiring user confirmation for orders and high-risk operations like withdrawals. No evidence of data exfiltration, malicious execution, or prompt injection was found in SKILL.md or _meta.json.