xcard-trading

Trade security tokens on the XCard platform — check balances, place orders, view market data, and review trade history.

This skill appears to implement the expected XCard trading API and asks only for a single XCARD_API_KEY, which is appropriate. Before installing: (1) verify the skill's source — the homepage is a placeholder (github.com/YOUR_USERNAME/...), so confirm the repository and maintainer; (2) fix/confirm the env-var name (SKILL.md uses XCARD_API_KEY but some module files show XCard_API_KEY) and ensure the registry metadata correctly declares the required env var; (3) test with a read-only or limited-scope API key (or a sandbox account) before giving it access to a live trading-capable key; (4) confirm the agent will require explicit user confirmation before placing orders (the skill includes safety rules, but verify the running agent enforces them); (5) monitor and rotate the API key after initial use. These issues look like packaging sloppiness rather than malice, but do not give this skill full trading credentials until you verify the code/source and key scoping.

Type: OpenClaw Skill Name: xcard-trading Version: 1.0.0 The xcard-trading skill is a well-structured trading assistant for the XCard platform. It includes proactive security and safety instructions for the AI agent, such as explicitly forbidding the leakage of the XCARD_API_KEY and requiring mandatory user confirmation before executing any trade orders (api-orders.md). All defined API endpoints are restricted to the official domain (api.xcard.com), and there are no signs of data exfiltration, malicious execution, or prompt injection attacks.