mt5-trading-assistant

Automates MetaTrader 5 trading: connect, monitor accounts, execute buy/sell orders with SL/TP, retrieve market data, and manage positions via scripts.

This skill appears to implement the trading features it claims, but exercise caution before installing or running it: - Do not run these scripts against a live account until you have reviewed and replaced all credentials. Multiple scripts include plaintext account login/password/server values. Treat those as secrets and remove them from the repo. - Prefer using a config.py (kept out of version control) or environment variables (os.getenv) for MT5_LOGIN/MT5_PASSWORD/MT5_SERVER instead of hardcoded values. The SKILL.md recommends this, but the files still contain credentials that will be used if left unchanged. - Test only on a demo account first. A script can place/close real trades if connected to a live MT5 session and AutoTrading is enabled. - Restrict filesystem permissions on any config file you create and add config.py to .gitignore. Consider rotating passwords if you have ever run the included credentials. - Inspect the scripts yourself (they are plain Python) and remove unused example credentials. If you are concerned about an agent running the skill autonomously, avoid enabling autonomous invocation for agents that have access to real trading credentials. If you want, I can: (a) list every file/location where credentials appear, (b) suggest exact code edits to switch to environment variables, or (c) produce a safe config.py template using os.getenv().

Type: OpenClaw Skill Name: mt5-trading-assistant Version: 1.0.0 The skill bundle contains multiple scripts (e.g., scripts/mt5_buy.py, scripts/mt5_check.py, scripts/mt5_snapshot.py) with hardcoded MetaTrader 5 (MT5) credentials, including a specific login (277528870) and password (KKx88088@@@@) for an Exness trial server. While the documentation (SKILL.md and INSTALLATION.md) warns that these are demo credentials and provides security best practices, hardcoding credentials in distributed code is a significant security vulnerability. The skill provides powerful trading capabilities that could lead to financial loss if misused, though no evidence of intentional malice or data exfiltration was found.