Taco Connector

Interact with the Taco crypto trading platform via API. Use when the user wants to (1) get kline/candlestick market data, (2) check account balance and posit...

This skill appears to be a straightforward CLI client for the Taco trading API, but consider these before installing: - Source/ownership: the package homepage and source are missing and the owner id is unknown. If you do not trust the origin, review the full taco_client.py (including any truncated portions like the 'init' command) before running. - Sensitive data on disk: the API key (api_token), user_id, and trader_ids are stored in plaintext at ~/.openclaw/workspace/taco/config.json. Ensure file permissions restrict access (chmod 600) and avoid reusing high-privilege keys. - Network exposure: the script will transmit your api_token to https://api.taco.trade for authenticated operations. Only use an API key with limited scopes and with exchanges/accounts you trust. - Redundancy & review: the token is included both in the Authorization header and in request bodies—this is odd but documented in the references; inspect the code to confirm there are no other external endpoints or logging of secrets. - Operational safety: if you plan to use open/close position commands, test with a demo account or very small notional amounts first and ensure the trader_ids configured are correct. If you are comfortable with these risks and verify the code, the skill is coherent with its stated purpose. If you cannot verify the source, proceed with caution or avoid installing.

Type: OpenClaw Skill Name: taco Version: 1.1.1 The 'taco' skill is a functional trading CLI for the Taco crypto platform (api.taco.trade). The Python client (scripts/taco_client.py) implements standard API interactions for market data, account management, and trade execution, with technical indicator calculations performed locally. It follows a clear setup process for managing user credentials in a local config file and lacks any indicators of malicious intent, such as data exfiltration, obfuscation, or unauthorized command execution.