Portfolio Trader

Connect to a user's investment accounts via SnapTrade SDK and generate portfolio reports (e.g., daily total value). Use when the user wants SnapTrade-based b...

This skill appears to do what it claims: connect to SnapTrade, create/refresh connections, compute totals, and place/watch orders. Before installing: (1) Understand that you must supply SnapTrade client_id and consumer_key and protect the local config file (keep it chmod 600 and do not commit it). (2) Review and confirm the snaptrade-python-sdk package/version in requirements.txt comes from the official source before running pip install. (3) Be aware the scripts can place force orders — if you do not want automated trading, either avoid running the order scripts or disable autonomous model invocation for this skill / require explicit user approval before any order is placed. (4) Test with a read-only or sandbox SnapTrade account if possible to validate behavior without financial risk. (5) If you need stricter credential handling, consider putting credentials in a vault/secure env instead of the workspace file.

Type: OpenClaw Skill Name: portfolio-trader Version: 1.1.0 The skill is classified as suspicious due to the high-impact capabilities it grants to the AI agent, specifically the instruction in `SKILL.md` to schedule a cron job for daily reports and the ability to place financial buy/sell orders via `scripts/snaptrade_order.py`. While these actions align with the stated purpose of a 'portfolio trader' skill, scheduling system-level tasks and executing financial transactions are powerful capabilities that, if exploited via prompt injection, could lead to significant harm. The code itself does not exhibit clear malicious intent like data exfiltration or unauthorized remote control, but the broad permissions and high-impact actions warrant a 'suspicious' classification rather than 'benign'.