eToro Public API — full trading, market data, social, and watchlist integration. Supports SSO, Bearer, and API key auth.

This skill exposes live trading endpoints and lists several authentication modes but does not declare how credentials are provided or protected. Before installing or invoking it: (1) verify the API base URL and official documentation—this package has no homepage/source link; (2) never run trading actions without explicitly switching to demo mode until you have validated requests; (3) avoid pasting secrets into free-text prompts—use a secure credential input mechanism and confirm where logs are written; (4) ask the publisher to declare required env vars (or a secure auth flow) and to remove or clarify 'log full request details' so sensitive headers are not stored or transmitted; (5) if you proceed, test only with demo accounts and carefully audit any logs to ensure API keys/tokens are not being captured or sent to external endpoints.

Type: OpenClaw Skill Name: etoro-trading-api Version: 1.0.0 This skill is classified as suspicious due to its inherent high-risk capabilities. The `SKILL.md` explicitly defines tools for real financial trading execution (e.g., `open_position_by_amount`, `close_position`) and instructs the AI agent to default to 'real' trading mode. While there is no evidence of intentional malicious behavior from the skill developer (e.g., data exfiltration, backdoors), the direct access to financial transactions and the default to real mode present a critical vulnerability. A compromised or prompt-injected agent could be manipulated to perform unauthorized financial operations, leading to significant financial loss. The requirement for `curl` and `python3` also grants the agent access to powerful system tools.