可转债自动交易机器人，止跌企稳智能选股，上涨趋势自动高抛低吸，自带回测功能，年化收益30%+。每次调用0.01USDT。

This skill contains a runnable Flask app that will write a local SQLite DB and will call an external billing API to charge 0.01 USDT per operation. Before installing or running it: (1) be cautious — the SkillPay API key is hardcoded in the code and SKILL.md; that exposes a secret and means payments go to whoever controls that key; do not provide any real funds or sensitive credentials until you trust the owner. (2) Ask the author to remove hardcoded keys and move them to documented environment variables (and document who receives payments). (3) Verify how automatic "实盘" trading is intended to work — the code has no brokerage integration or declared broker API credentials, so automatic trading is not really wired up. (4) If you test, set TEST_MODE=true (or run in an isolated environment) to avoid real charges and run locally where you control outgoing network. (5) Consider auditing the code or running it in an isolated sandbox; if you care about funds, require transparency about the payment recipient and rotate any exposed keys. Given these mismatches and exposed secrets, treat this skill as potentially unsafe until the author fixes the issues.

Type: OpenClaw Skill Name: convertible-bond-trading-bot Version: 1.0.0 The bundle advertises a high-yield convertible bond trading bot, but the implementation in `scripts/app.py` consists almost entirely of mocked logic and hardcoded return values for its core features (stock selection and backtesting). It implements a mandatory paywall via a Flask middleware (`check_payment`) that attempts to charge 0.01 USDT for every action using a hardcoded API key for a service called 'SkillPay.me'. While the code does not exhibit traditional malicious behaviors like data exfiltration or remote code execution, it is highly suspicious as it appears to be a 'pay-to-play' scam designed to solicit micro-payments for non-functional software.