Automates dollar-cost averaging into BTC/ETH during extreme fear (F&G <10) and rebalances to yield above F&G 50, removing emotion from fear buying.

This skill generally does what it says (fetches Fear & Greed and Binance prices, backtests, and records DCA buys), but it contains a few red flags you should consider before installing or running it: - 'Live' mode is misleading: executor.py prints that live requires API keys, but there is no code to place orders on an exchange or to read/store API keys. If you expect automatic trading, this skill will not perform real exchange orders as-is. Do not assume funds will be moved — the script only updates local state. - Hard-coded absolute path in backtest.py: it writes results to /home/bowen/..., which may fail or overwrite files on your system. Expect to edit that path before running or run in an isolated environment. - No declared credential handling: if you modify this to integrate real execution, you must add secure credential handling (do NOT paste API keys into the script or commit them). - Network I/O: the scripts call external services (api.alternative.me and api.binance.com). That is expected, but be aware of network traffic and possible rate limits. - Source trustworthiness: no homepage and unknown source. Prefer to run only after reviewing and/or auditing the code, run in --dry-run or --paper mode first, and execute in an isolated environment (container or sandbox). If you plan to enable actual trading, implement vetted exchange integration, secrets management, and thorough testing before connecting real funds.

Type: OpenClaw Skill Name: fear-harvester Version: 0.1.0 The OpenClaw skill 'FearHarvester' is benign. It implements a cryptocurrency trading strategy by monitoring the Fear & Greed index and BTC prices from legitimate public APIs (alternative.me, Binance). The `SKILL.md` contains no prompt injection attempts. The Python scripts (`backtest.py`, `executor.py`, `signals.py`) perform their stated functions without attempting to exfiltrate data, execute arbitrary commands, or establish persistence. The `executor.py` script correctly uses relative paths for its state file, and while `backtest.py` uses a hardcoded absolute path (`/home/bowen/clawd/skills/fear-harvester/data/backtest_results.json`) for saving results, this is a minor portability flaw rather than a security vulnerability or malicious act, as it targets a data file within the skill's presumed installation directory.