Quant Trader

Professional quantitative trading system for cryptocurrency - backtesting, paper trading, live trading, and strategy optimization

This skill appears to be a legitimate trading framework, but there are mismatches and risks you should address before installing or giving it credentials: - Verify the repository and publisher: visit https://github.com/ZhenRobotics/openclaw-quant, check the maintainer, commit history, issues, and community. The registry metadata lacks a homepage/source, which lowers confidence. - Inspect code before running: review requirements.txt and the live/trading/broker code (live.py, broker.py) for any hardcoded endpoints, telemetry, or exfiltration logic. - Use testnet and minimal permissions: when trying live features, use exchange testnet keys or API keys limited to trading and ideally without withdrawal permissions. Start with very small amounts. - Don’t expose real secrets to the agent automatically: the SKILL.md examples use BINANCE_API_KEY/BINANCE_API_SECRET and telegram tokens—treat these as sensitive. Consider using ephemeral/test credentials or a secrets manager and avoid pasting keys into chat. - Run in an isolated environment: use a VM or container and a Python virtualenv to contain any installed packages. - Audit dependencies: ensure requirements.txt does not include suspicious or unmaintained packages, and pin versions. If you want higher confidence, provide the actual GitHub repo link and checksums or ask the skill publisher for provenance and a signed release; with that we could re-evaluate and raise confidence.

Type: OpenClaw Skill Name: quant-trader Version: 1.0.0 The quant-trader skill bundle describes a legitimate quantitative trading system for cryptocurrency. It includes comprehensive instructions for the AI agent that emphasize safety, such as requiring explicit user confirmation before executing live trades and prohibiting the agent from providing financial advice. While the skill handles sensitive API keys and financial transactions, the provided documentation (SKILL.md) and code examples follow industry best practices (e.g., using environment variables) and lack any indicators of malicious intent or data exfiltration.