Moomoo Trading

Use OpenD-backed moomoo/Futu scripts for quotes, K-lines, price alerts, portfolio/account checks, and stock order execution. Triggers on moomoo, futu, OpenD,...

This skill appears to implement the trading and data features it advertises and uses a local OpenD gateway; however: - The trade script expects a live-trading unlock password via the environment variable MOOMOO_UNLOCK_PASSWORD (or an alternate env var you pass). The skill metadata does not declare this env var — treat this as a missing metadata declaration, not a functional bug. Do not pass any trading password on the command line; use an env var as instructed. - By default scripts run in simulated mode; explicit flags (--env real --confirm) are required for live orders. Only enable real trading when you intend to and after you verify the code and OpenD connection. - Review the included Python files yourself (they are bundled) and ensure you trust the source before installing or running live operations. If you plan to use live trading, consider creating a dedicated account with limited permissions for automation and avoid storing the unlock password in shared or long-lived places. - You will need to pip install futu-api or moomoo-api and run a local OpenD instance (127.0.0.1:11111 by default). Installing packages pulls code from PyPI — verify package sources and versions if supply-chain risk is a concern. If the registry entry is intended to require the unlock password, ask the publisher to add that environment variable to the skill metadata so tool ecosystems can make the requirement explicit and reduce accidental insecure usage.

Type: OpenClaw Skill Name: moomoo-trading Version: 1.0.0 The moomoo-trading skill bundle is a legitimate implementation of a trading interface for the moomoo/Futu OpenAPI. It provides scripts for market data, portfolio management, and order execution through a local OpenD gateway. The code includes appropriate safety measures, such as requiring explicit confirmation and environment variables for live trading passwords, and it lacks any signs of data exfiltration, malicious execution, or prompt injection.