← 返回 Skills 市场
bywallace

Kubera

作者 Brett Wallace · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
1025
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install kubera-skill
功能描述
Read and manage Kubera.com portfolio data (net worth, assets, debts, allocation, holdings). Use when a user asks about their finances, net worth, portfolio, investments, holdings, asset allocation, or wants to update asset values in Kubera. Works with any AI agent or CLI that can run Python scripts.
使用说明 (SKILL.md)

Kubera

Query and update portfolio data via the Kubera API.

Setup

Set environment variables:

export KUBERA_API_KEY="your-api-key"
export KUBERA_SECRET="your-api-secret"

Generate keys at Kubera Settings > API. Read-only is recommended unless updates are needed.

Usage

Run scripts/kubera.py with a subcommand:

# List portfolios
python3 scripts/kubera.py portfolios

# Net worth summary with allocation + top holdings
python3 scripts/kubera.py summary

# Full portfolio JSON (for detailed analysis)
python3 scripts/kubera.py json

# List assets, optionally filter by sheet or sort
python3 scripts/kubera.py assets --sheet Crypto --sort value

# Search assets by name/ticker/account
python3 scripts/kubera.py search "shopify"

# Update an asset (requires write permission + --confirm flag)
python3 scripts/kubera.py update \x3CITEM_ID> --value 5000 --confirm

Use --json on summary, assets, search, or portfolios for machine-readable output. Use json subcommand for the complete raw API response.

For multi-portfolio accounts, pass --portfolio \x3CID>. Single-portfolio accounts auto-select.

Rate Limits

  • 30 req/min, 100/day (Essentials) or 1,000/day (Black)
  • Cache json output when running multiple queries in a session

API Details

See references/api.md for authentication, endpoints, and object schemas.

安全使用建议
This package appears to be an on-purpose Kubera API client (it signs requests and talks only to api.kubera.com). However: 1) The registry metadata did not declare the two sensitive environment variables the script actually needs (KUBERA_API_KEY and KUBERA_SECRET) — that discrepancy is suspicious and may indicate sloppy packaging or omission. 2) Only install/use this skill if you trust the source; there is no homepage and the owner is an ID string. 3) If you proceed, create a read-only Kubera API key when possible, avoid passing secrets on the command line (prefer env vars), and run the script in an isolated environment. 4) Review the full scripts/kubera.py file locally (it is included) to confirm there are no hidden network calls or modifications beyond the Kubera API before providing credentials. 5) If you want higher assurance, ask the publisher to correct the registry metadata to list required env vars and provide a verifiable homepage or source repository.
功能分析
Type: OpenClaw Skill Name: kubera-skill Version: 1.0.0 The skill bundle is a legitimate client for the Kubera API, designed to read and manage portfolio data. It uses standard and secure practices for API interaction, including HMAC-SHA256 authentication and retrieving credentials from environment variables. The `scripts/kubera.py` file makes network requests only to `https://api.kubera.com` and includes a `--confirm` flag for write operations, which is a good safety measure. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the AI agent in `SKILL.md`.
能力评估
ℹ Purpose & Capability
Name/description, SKILL.md, references/api.md, and scripts/kubera.py consistently implement a Kubera API client (read and update portfolio data). However the registry metadata claims no required environment variables or primary credential even though both the README and the script require an API key and secret. That mismatch is unexpected and reduces trust in packaging/metadata.
✓ Instruction Scope
Runtime instructions (SKILL.md) are narrowly scoped to interacting with the Kubera API: set KUBERA_API_KEY/KUBERA_SECRET and run the provided Python script with the listed subcommands. The code only reads those credentials (or CLI args), calls api.kubera.com endpoints, and prints results; it does not attempt to read unrelated system files, other environment variables, or post data to other hosts.
✓ Install Mechanism
There is no install spec (instruction-only skill with an included Python script). The script uses only Python standard library modules (urllib, hmac, hashlib, etc.), so no additional package installs are required. This is low-risk from an installer perspective.
⚠ Credentials
The skill requires KUBERA_API_KEY and KUBERA_SECRET (SKILL.md and scripts/kubera.py) but the registry metadata lists no required env vars and no primary credential. Requiring two sensitive credentials is proportionate to the purpose, but failing to declare them in metadata is an inconsistency that could lead to accidental credential exposure or misconfiguration. Also the script accepts credentials via CLI args, which can expose secrets in process lists or logs if used improperly.
✓ Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. It does not attempt to modify other skills or system-wide settings. Autonomous invocation is allowed by default (disable-model-invocation=false), which is normal for skills; this combined with the credential mismatch is why caution is advised, but the skill does not request unusual persistence.
如何使用
  1. 确保已安装 OpenClaw（本地或 Docker 部署）
  2. 在对话框中输入安装命令：/install kubera-skill
  3. 安装完成后，直接呼叫该 Skill 的名称或使用 /kubera-skill 触发
  4. 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
kubera-skill v1.0.0 - Initial release. - Enables reading and managing portfolio data (net worth, assets, debts, allocation, holdings) via the Kubera.com API. - Provides CLI scripts for querying portfolios, summaries, searching, and updating asset values. - Supports machine-readable JSON output and filtering/sorting functionality. - Documents environment variable setup, rate limits, and API references.
元数据
Slug kubera-skill
版本 1.0.0
许可证 —
累计安装 0
当前安装数 0
历史版本数 1
常见问题

Kubera 是什么？

Read and manage Kubera.com portfolio data (net worth, assets, debts, allocation, holdings). Use when a user asks about their finances, net worth, portfolio, investments, holdings, asset allocation, or wants to update asset values in Kubera. Works with any AI agent or CLI that can run Python scripts. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1025 次。

如何安装 Kubera？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install kubera-skill」即可一键安装，无需额外配置。

Kubera 是免费的吗？

是的，Kubera 完全免费（开源免费），可自由下载、安装和使用。

Kubera 支持哪些平台？

Kubera 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Kubera？

由 Brett Wallace（@bywallace）开发并维护，当前版本 v1.0.0。

推荐 Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463283 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259410 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200423 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191115 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190156 · by oswalpalash

💬 留言讨论