portfolio tracking

An investment portfolio tracker that runs entirely locally. All data stays in ~/.portfolio-tracker/.

This skill largely matches its stated purpose — local CLI scripts that read/write ~/.portfolio-tracker — but there are important caveats you should consider before installing: - The code performs network calls. Syncing requires contacting Binance (using the API key/secret you provide), IBKR, price providers (CoinGecko/Yahoo), and public EVM RPC endpoints (e.g., eth.llamarpc.com). If you expect complete offline/local operation, that expectation is incorrect. - API keys and IBKR tokens are stored unencrypted in ~/.portfolio-tracker/config.json. The skill suggests chmod 600, which helps, but the secret remains plaintext on disk. Use only read-only Binance keys and consider whether you want secrets stored there. - Public RPC providers will see wallet addresses you query. If you are privacy-sensitive about addresses queried (e.g., connecting a hot wallet), consider pointing the code to your own RPC node or a privacy-respecting provider. - The install step requires running npm install in the scripts folder; that pulls packages from the public npm registry (ethers, etc.). If you want higher assurance, review the package-lock and audit dependencies before installing. - If you proceed: review the source files (already included), run in a sandboxed environment if possible, create read-only exchange keys, set tight file permissions on ~/.portfolio-tracker/config.json, and verify/change the hard-coded RPC endpoints if you prefer different providers. If you want, I can: (a) point out exact lines where network calls occur, (b) show how to modify the RPC endpoints to a provider you trust, or (c) produce a secure checklist for creating read-only keys and safely storing them.

Type: OpenClaw Skill Name: portfolio-tracking-skill Version: 1.0.0 The skill is classified as suspicious due to security vulnerabilities related to the handling of sensitive API keys and secrets. Specifically, `scripts/binance-sync.ts` and `scripts/ibkr-sync.ts` pass API keys/secrets as command-line arguments (`process.argv`), which can expose these credentials to other users on a multi-user system or in system logs. Additionally, API keys and wallet addresses are stored in plaintext JSON in `~/.portfolio-tracker/config.json`. While the documentation (`SKILL.md`, `README.md`, `commands/setup.md`) explicitly states local storage and recommends `chmod 600` for the config file, this storage method and CLI argument passing represent a vulnerability, not malicious intent to exfiltrate data. All network calls are to legitimate financial/crypto APIs for read-only data, and there is no evidence of data exfiltration, malicious execution, persistence mechanisms, or harmful prompt injection attempts against the agent.