Questrade

Access Questrade brokerage accounts and Canadian/US market data for balances, positions, orders, executions, Level 1 quotes, historical candles, and symbol s...

This skill appears to implement the Questrade API correctly, but the registry metadata failed to declare the sensitive credentials it needs. Before installing: (1) only provide your Questrade refresh token if you trust the skill source — verify the owner and code. (2) Be aware the script will save rotated refresh tokens and an access-token cache to ~/.openclaw in plaintext; restrict those files' permissions (e.g., chmod 600) or keep them in a locked environment. (3) Prefer creating a read-only/token limited account if possible, and enable QUESTRADE_READ_ONLY to block orders. (4) Consider running the script in an isolated environment (container/VM) if you are unsure. (5) Ask the publisher to update the registry metadata to declare QUESTRADE_REFRESH_TOKEN as the primary credential and to document file-write behavior so automated systems can make an informed install decision.

Type: OpenClaw Skill Name: questrade Version: 1.0.0 The 'questrade' skill is a legitimate integration for the Questrade brokerage API. It implements standard OAuth 2.0 token rotation by reading and updating a local credentials file (~/.openclaw/credentials/questrade.json), which is necessary for Questrade's API requirements. The script (scripts/questrade_cli.py) includes safety guardrails such as a read-only mode and confirmation prompts for order placement, and all network traffic is directed to official Questrade domains (questrade.com).