← Back to Skills Marketplace
334
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install vbrokers-trading
Description
VBrokers (华盛通 VCL HK) trading automation via OpenAPI Gateway running on localhost port 11111. Use when: setting up VBrokers or 华盛通 account access, authentica...
Usage Guidance
This skill appears to implement exactly what it claims: a local OpenAPI Gateway client for VBrokers trading. Before installing or running it, do the following: (1) Verify the local Gateway (华盛通OpenAPIGateway.app) you will connect to is the official application and actually running on 127.0.0.1:11111. (2) Inspect the bundled scripts (vbrokers_client.py) yourself — it contains a hardcoded AES key used to encrypt your trading password; confirm this matches vendor documentation or replace it with a secure/configurable key if appropriate. (3) Never hand your real account credentials to untrusted code — test with a demo/small order first. (4) Ensure pycryptodome is installed from a trusted source. The skill does not exfiltrate data to remote hosts, but because it can place/cancel real orders, treat it as high-impact: validate behavior in a safe environment before granting it access to live money.
Capability Analysis
Type: OpenClaw Skill
Name: vbrokers-trading
Version: 1.0.0
The skill bundle provides automated trading capabilities for VBrokers via a local gateway, which is a high-risk activity. It contains security vulnerabilities in `scripts/vbrokers_client.py`, including a hardcoded AES key (`AES_KEY_B64`) and the use of the weak AES-ECB encryption mode for trading passwords. While these flaws pose a risk of credential compromise if the key is not a generic API requirement, there is no evidence of intentional malicious behavior, backdoors, or data exfiltration to external endpoints.
Capability Assessment
Purpose & Capability
Name/description match the included Python client and API reference. The code exclusively targets the local OpenAPI Gateway (http://127.0.0.1:11111) and implements trading, quotes, K-lines, and helper logic described in the SKILL.md. No unrelated cloud services, binaries, or secrets are requested.
Instruction Scope
SKILL.md stays on-topic: it tells you to run the local Gateway app, install pycryptodome, copy/import the provided vbrokers_client.py, and call functions like trade_login, get_account_funds, place_order, etc. The instructions do not direct the agent to read arbitrary files, other env vars, or to transmit data to endpoints other than the specified localhost gateway.
Install Mechanism
There is no install spec (instruction-only with bundled client code). The only runtime dependency mentioned is pycryptodome (pip), which is appropriate for AES operations. No remote downloads or archive extracts are performed by the skill itself.
Credentials
The skill does not request environment variables or external credentials. It asks callers to pass their trading password to trade_login at runtime. The client contains a hardcoded base64 AES key (AES_KEY_B64) used to encrypt the password before sending it to the local gateway — this is plausible if the provider supplies a fixed key, but it is a transparency detail you should verify (see guidance).
Persistence & Privilege
always is false and the skill is user-invocable. It does not request permanent agent presence or modify other skills' configurations. The client only communicates with the local Gateway and does not persist credentials itself.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install vbrokers-trading - After installation, invoke the skill by name or use
/vbrokers-trading - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
VBrokers (华盛通 VCL HK) OpenAPI trading automation. Real-time quotes, order management, stop-loss/take-profit, session-aware price polling for US/HK/A stocks.
Metadata
Frequently Asked Questions
What is VBrokers Trading?
VBrokers (华盛通 VCL HK) trading automation via OpenAPI Gateway running on localhost port 11111. Use when: setting up VBrokers or 华盛通 account access, authentica... It is an AI Agent Skill for Claude Code / OpenClaw, with 334 downloads so far.
How do I install VBrokers Trading?
Run "/install vbrokers-trading" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is VBrokers Trading free?
Yes, VBrokers Trading is completely free (open-source). You can download, install and use it at no cost.
Which platforms does VBrokers Trading support?
VBrokers Trading is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created VBrokers Trading?
It is built and maintained by lcy360 (@lcy360); the current version is v1.0.0.
More Skills