SMC Multi-Strategy Paper Trader

Paper trading monitors for SMC (Smart Money Concepts) + Macro Rotation strategies. Includes swing (4H BoS+FVG), day (1H BoS+FVG+CVD), coordinated 8D/2S orche...

This skill appears coherent and implements the paper-trading system it documents. Before installing or running it, consider: 1) Scripts create and modify JSON files under ~/.openclaw/workspace/trading — back up any existing data in that path. 2) macro-rotation.js uses child_process.execSync to curl FRED CSVs (shell execution is limited here but higher-risk than using the https module); if you prefer, review/replace the execSync call with an https fetch. 3) Several helper functions (apiFetch2 / apiFetch2Put) are present that will send Authorization headers if a token is supplied — do not provide GitHub or other service tokens to this skill unless you understand why and trust the destination. 4) Run the scripts in a sandboxed environment or with limited permissions if you plan to let them run autonomous cron jobs. If you want higher assurance, ask the author for justification of the apiFetch2 functions and/or remove/disable any code paths that would accept an externally provided token.

Type: OpenClaw Skill Name: skill-smc-multi-strategy-paper-trader Version: 2.1.0 The skill bundle implements a multi-strategy paper trading system that exhibits high-risk behaviors and security vulnerabilities. Multiple scripts, including macro-rotation.js and paper-monitor-v5.js, read a sensitive GitHub token from the user's home directory (~/.github_token) and exfiltrate portfolio data to a hardcoded external repository (Zero2Ai-hub/Jarvis-Ops). Furthermore, macro-rotation.js utilizes execSync to run curl commands with string interpolation, creating a significant shell injection risk. While these features appear designed for automated reporting and synchronization, the reliance on local secrets and hardcoded remote endpoints without explicit user configuration is highly suspicious.