vibetrading-global-signals

Query AI-generated trading signals from vibetrading-datahub. Signals are produced by autonomous agents analyzing whale activity, news, funding rates, and technical indicators.

Key things to check before installing or running this skill: - Verify the endpoint ownership and trustworthiness of https://vibetrading.dev (the changelog notes a domain move from datahub-prd.fmcp.xyz). Ensure you are comfortable sending queries to that domain. - Be aware npm install will pull packages from the public npm registry (axios, https-proxy-agent and many transitive deps). Consider running npm audit, reviewing package-lock.json, and installing in an isolated environment (container or VM) if you’re concerned about supply-chain risk. - The SKILL.md/metadata mismatch: the skill lists curl and jq as required, but the runtime is Node.js. Make sure Node >=18 is available before running the scripts. - The skill claims the API is open (no token). That is plausible but unusual for a signals/data API — confirm the API really requires no auth and has acceptable rate limits and privacy practices. - If you will schedule cron/automated runs, limit frequency to avoid accidental rate limits or unexpected data exfil (keep it local, don’t forward raw responses to third parties). If you want a higher-confidence assessment, provide: (1) confirmation of who operates vibetrading.dev or an official homepage; (2) the exact environment where you plan to run the skill (so I can advise about isolation); or (3) a copy of the API responses (sample JSON) so I can verify the scripts’ assumptions and check for unexpected data fields or callbacks.

Type: OpenClaw Skill Name: vibetrading-global-signals Version: 1.0.1 This skill bundle is benign. It provides scripts to query AI-generated trading signals from `https://vibetrading.dev/api/v1`. The JavaScript files (`scripts/*.js`) use the `axios` library to make HTTP GET requests, constructing URLs safely with `URLSearchParams` based on command-line arguments. There is no evidence of malicious intent such as data exfiltration, unauthorized command execution, persistence mechanisms, or prompt injection attempts in the `SKILL.md` or `README.md` files. All dependencies listed in `package.json` and `package-lock.json` are standard and appropriate for the stated purpose.