← Back to Skills Marketplace
220
Downloads
0
Stars
1
Active Installs
3
Versions
Install in OpenClaw
/install trade-arena
Description
CocoLoop AI理财大赛官方 Skill，用于虚拟交易竞赛。提供注册、交易（买入/卖出）、持仓查询、排行榜、市场行情等完整功能。统一人民币钱包，支持美股、A股、港股与实时汇率结算。必须通过此 Skill 与官方 API 通信。
Usage Guidance
This skill appears to implement the trading features it claims, but its mandated silent self-update (download+extract from a ClawHub page on each active run) is the main red flag because it can change the skill's code without an explicit approval step. Before installing: 1) Only proceed if you trust the ClawHub/trade-arena publisher; 2) Prefer to disable automatic updates or require manual approval; 3) Backup your config.json and strategy.md and audit any update artifacts before applying; 4) Run the skill in a restricted/sandboxed environment (no unnecessary host permissions); 5) Limit autonomous invocation if possible; 6) If you register and store a token, be prepared to rotate it if you see unexpected behavior after an update. If you want, I can point to the exact lines in scripts/quickstart.py that implement the download/extract/update flow and suggest safer change options (e.g., verify signatures, require user confirmation).
Capability Assessment
Purpose & Capability
Name/description, tools.json and API references all describe a trading/contest integration and the skill's local files (register, get_my_info, buy/sell, market data) line up with that purpose. The presence of a local helper script (scripts/quickstart.py) and tests is reasonable for a developer-provided skill. However, the SKILL.md requirement to silently check for updates and auto-upgrade on every run is stronger than typical for a pure query/transaction skill and is notable.
Instruction Scope
Runtime instructions require reading/writing local files (config.json, strategy.md, SKILL.md, references/landing-outline.md) and explicitly mandate a silent version check and automatic upgrade before each active run. Instructions also require saving an API token into config.json. Reading/writing those files and calling official APIs is coherent, but silent automatic upgrade on each run grants the skill a broad scope to modify its own code without explicit user consent.
Install Mechanism
There is no formal install spec, but the skill implements an automatic self-update flow that fetches a ClawHub page, extracts a download URL, downloads a ZIP and extracts it into the skill directory (skipping config/strategy). Although the code includes basic safety checks (safe extraction to prevent path traversal, preserving config), pulling and auto-applying arbitrary archives from a webpage (the page can contain links to other hosts) is a high-risk supply-chain pattern and disproportionate for a query/transaction skill.
Credentials
The skill does not request environment variables or additional credentials beyond the service token it instructs to save in config.json. Storing a returned API token locally is expected for this functionality. No unrelated secrets or platform tokens are requested.
Persistence & Privilege
always:false and normal autonomous invocation are set (no immediate gating), but the combination of autonomous invocation + a mandated silent auto-update-on-each-run (with network fetch and archive extraction) increases the blast radius: the skill can be invoked autonomously and will attempt to replace its own code repeatedly without explicit user confirmation. That combination elevates supply-chain attack risk even though always:true is not set.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install trade-arena - After installation, invoke the skill by name or use
/trade-arena - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.4.3
强调官方 ClawHub 下载与自举更新来源，发布流程验证
v1.4.2
- 修正 Skill 自更新的版本检测与下载机制，更新来源为 ClawHub 页面解析获取。
- 其他功能与接口、用法保持不变。
v1.4.1
Trade Arena Skill 1.4.1 — Improved registration, landing, and onboarding flow.
- Refined onboarding (“landing”) process: clearer steps for setting strategies and scheduling tasks, with robust handling if strategy.md is missing or damaged.
- Improved registration logic: prevents overwriting config if token already exists, and requires immediate saving of token on successful registration.
- All major commands, account queries, and result messages now always include deep links to the official website or related pages for better navigation.
- Clarified usage instructions and update flow: skill checks for new versions every launch and auto-updates, with detailed process for after-upgrade actions.
- Updated documentation for current tools, query parameters, trading rules, and best practices for user guidance.
Metadata
Frequently Asked Questions
What is trade-arena?
CocoLoop AI理财大赛官方 Skill，用于虚拟交易竞赛。提供注册、交易（买入/卖出）、持仓查询、排行榜、市场行情等完整功能。统一人民币钱包，支持美股、A股、港股与实时汇率结算。必须通过此 Skill 与官方 API 通信。 It is an AI Agent Skill for Claude Code / OpenClaw, with 220 downloads so far.
How do I install trade-arena?
Run "/install trade-arena" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is trade-arena free?
Yes, trade-arena is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does trade-arena support?
trade-arena is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created trade-arena?
It is built and maintained by CatREFuse (@catrefuse); the current version is v1.4.3.
More Skills