← 返回 Skills 市场

Duola Quant Copy Engine

Name: Duola Quant Copy Engine
Author: duolaamengweb3

作者 duolaAmengweb3 · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

356

总下载

当前安装

版本数

在 OpenClaw 中安装

/install duola-quant-copy-engine

功能描述

Institutional-grade execution playbook for the published `duola` Polymarket copy-trading CLI in lobster-agent workflows. Use when tasks require production-st...

使用说明 (SKILL.md)

Duola Lobster Agent

Overview

Execute the standard operating workflow for duola as an agent toolchain. Prefer staged rollout: sync -> backtest -> doctor -> limited live start -> status/log review.

Billing Setup (SkillPay)

Configure once in runtime environment:

export SKILLPAY_API_URL="https://skillpay.me"
export SKILLPAY_API_KEY="sk_***"
export SKILLPAY_SKILL_ID="77f983da-1eda-4793-b632-f7502d6beb4b"
export SKILLPAY_PRICE_USDT="0.01"

Use billing gate with commands that support --billing-user-id. Supported: sync, backtest, follow start, autopilot onboard, autopilot start.

Check billing endpoints from CLI:

duola billing balance --user-id \x3Cuser_id> --output json
duola billing charge --user-id \x3Cuser_id> --amount 0.01 --output json
duola billing payment-link --user-id \x3Cuser_id> --amount 1 --output json

Execution Workflow

1) Verify Runtime and CLI

Run:

node -v
npm view duola version
duola --version

If duola is missing, install:

npm install -g duola

If global install is restricted, run project-local CLI:

npm install
npm run build
node dist/index.js --version

2) Register and Inspect Leader

duola leader add \x3Cleader_address> --name \x3Calias>
duola leader list --output json
duola leader inspect \x3Calias> --output json

Use deterministic aliases and keep one alias per leader address.

3) Sync and Baseline Backtest

duola sync \x3Calias> --limit 500 --output json
duola backtest \x3Calias> --lookback 30d --fixed-usd 25 --output json

If results are weak, tune before live mode:

raise --min-liquidity
increase --min-time-to-expiry
reduce --fixed-usd

4) Run Doctor Diagnostics

duola doctor \x3Calias> --output json

Require passing API connectivity and secret checks before live mode.

5) Onboard Autopilot (Preferred Live Path)

Use stdin for private key and do not print secrets:

printf '%s' '\x3Cprivate_key>' | duola autopilot onboard \x3Cleader_address> \\
  --name \x3Calias> --private-key-stdin --profile balanced --sync-limit 200

Start with explicit confirmation phrase:

duola autopilot start \x3Calias> --confirm-live "I UNDERSTAND LIVE TRADING" --detach

6) Operate and Observe

duola autopilot status \x3Calias> --output json
duola follow logs \x3Calias> --tail 100 --output json
duola autopilot stop \x3Calias> --output json

For limited-cycle validation:

duola follow start \x3Calias> --confirm-live "I UNDERSTAND LIVE TRADING" --max-cycles 5 --output json

Reporting Contract

Return concise machine-usable summaries:

leader: alias, address
sync: fetched/inserted/skipped counts
backtest: win rate, total pnl, max drawdown, executed signals
doctor: failed checks and remediation
autopilot: status, detach state, heartbeat, recent errors

When live start is blocked, report the exact failed precondition and the next command.

安全使用建议

Do not run this skill or export secrets for it until you verify its source and credential requirements. Ask the publisher for a source repository or package name and confirm the SkillPay domain and ownership. Before running: 1) Inspect the 'duola' npm package on the registry (or prefer a pinned git release). 2) Never paste private keys into an unverified agent — prefer hardware or ephemeral signing. 3) Demand that required env vars (SkillPay API key, skill id) be declared in metadata and justification for why SkillPay is needed. 4) If you must test, do so in an isolated environment with fake keys and a read-only account. If the publisher cannot provide a clear source and rationale for the billing integration and secret handling, treat the skill as untrusted.

功能分析

Type: OpenClaw Skill Name: duola-quant-copy-engine Version: 1.0.0 The skill bundle provides instructions for an AI agent to install and operate a crypto trading CLI tool (`duola`) for Polymarket. High-risk behaviors include the global installation of an external npm package, the handling of sensitive cryptocurrency private keys via stdin, and integration with an external billing service (skillpay.me). While SKILL.md includes operational safeguards like backtesting and diagnostic checks, the inherent risks associated with automated financial secret management and external code execution justify a suspicious classification.

能力评估

⚠ Purpose & Capability

The SKILL.md clearly implements a production operator for the 'duola' CLI and a third‑party billing gate (SkillPay). That purpose explains use of duola and billing calls, but the registry metadata lists no required environment variables or primary credential. The presence of SkillPay-specific env vars (SKILLPAY_API_URL, SKILLPAY_API_KEY, SKILLPAY_SKILL_ID) in the runtime instructions is inconsistent with the declared 'Required env vars: none'.

⚠ Instruction Scope

Runtime instructions direct the agent/operator to: export billing API keys, run billing commands, install and invoke the duola CLI, and feed a private key via stdin into 'duola autopilot onboard'. Asking for private keys and external billing operations is within a trading operator's scope, but these instructions also create an exfiltration risk (private key or billing key could be provided to external services). The SKILL.md gives broad discretion to run CLI installs and billing commands without any metadata that documents those external endpoints or who controls them.

ℹ Install Mechanism

This is an instruction-only skill (no install spec). It tells operators to install duola via 'npm install -g duola' or local npm build. Using npm is expected for a CLI, but the skill provides no source URL or repository for either the duola package or the skill itself. Verify the duola package provenance on the npm registry before running global installs.

⚠ Credentials

The instructions require several sensitive values (SKILLPAY_API_KEY, SKILLPAY_API_URL, SKILLPAY_SKILL_ID and user private keys) but the skill metadata declares none. There is no 'primary credential' or declared env list to explain where secrets should come from or how they will be protected. Requesting private keys for live trading is plausible, but the lack of metadata, source, or storage/rotation guidance is disproportionate and risky.

✓ Persistence & Privilege

The skill is 'always: false', user-invocable, and instruction-only with no install artifacts. It does not request persistent platform privileges or modify other skills. Autonomous invocation is allowed by default but not combined with other privilege escalations here.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install duola-quant-copy-engine
安装完成后，直接呼叫该 Skill 的名称或使用 /duola-quant-copy-engine 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial public release: institutional workflow for duola copy trading with SkillPay billing gates.

元数据

Slug duola-quant-copy-engine

版本 1.0.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题