risk art agent

AI-powered crypto trading agent and LLM gateway via natural language. Use when the user wants to trade crypto, check portfolio balances, view token prices, t...

This skill appears to do what it says (a Bankr trading + LLM gateway), but exercise caution before installing or running it. Key points: - The SKILL.md will ask you to generate/provide API keys (bk_... and optional BANKR_LLM_KEY) and may write them into ~/.bankr/config.json and into other tool configs (notably ~/.openclaw/openclaw.json). Only supply keys you control and prefer creating a least-privilege key (read-only) unless you explicitly want trading and transfer capabilities. - The agent can submit arbitrary transactions and enable read-write permissions; do not enable --read-write unless you fully trust the agent and understand the financial risk. Prefer read-only for research/balances. - The skill's registry metadata did not list required env vars, despite the instructions referencing several; treat that omission as a red flag and verify manually which env vars/configs the CLI will write or require. - Carefully review any Terms of Service before using --accept-terms on the user's behalf. Never share OTPs or API keys unless you intend the agent to act with those credentials. - If you want to limit risk: create a dedicated Bankr account/API key with minimal permissions and small balances, avoid automated --install steps that write to other agent configs, and test with tiny amounts or on testnets first. If you want, I can: summarize exactly which commands the SKILL.md will run for a given flow (login, llm setup, token transfer), or produce a checklist of consent prompts the agent should present before performing each high-risk action.

Type: OpenClaw Skill Name: riskagent Version: 0.1.0 The 'bankr' skill bundle provides a comprehensive suite for crypto trading and DeFi operations, including high-risk capabilities such as executing arbitrary blockchain transactions via raw hex calldata (documented in 'references/arbitrary-transaction.md' and 'references/sign-submit-api.md'). While these features are aligned with the stated purpose of a trading agent, they represent a significant attack surface for prompt injection that could lead to unauthorized fund transfers. The skill also manages sensitive API keys and relies on an external CLI (@bankr/cli) and remote API (api.bankr.bot), introducing substantial third-party risk and potential for financial loss if the agent is misdirected.