SnapTrade

Connect to a user's investment accounts via SnapTrade SDK and generate portfolio reports (e.g., daily total value). Use when the user wants SnapTrade-based brokerage connectivity (Webull, E*TRADE, etc.), connection portal links, account registration, or automated portfolio summaries.

This skill appears to implement exactly what it claims: SnapTrade connectivity, portal link generation, account listing, total-value reports, and placing/watching orders. Before installing or running it: 1) Verify the skill publisher and provenance (registry metadata shows no homepage/source) and audit the included code (you have the scripts locally). 2) Treat client_id/consumer_key and generated user_secret as sensitive — store them with strict permissions and do not commit them to version control. 3) Be aware the skill can place real trades; only run order scripts (buy/sell) if you intentionally permit live trading and understand the account/account-id you’re acting on. 4) When using pip to install the SDK, prefer running in an isolated virtualenv/container and confirm the snaptrade-python-sdk package/version integrity. 5) If you need higher assurance, validate network endpoints used by the SDK and test with a sandbox/demo SnapTrade account first.

Type: OpenClaw Skill Name: snaptrade Version: 1.0.0 The skill is classified as suspicious due to its high-risk capabilities, specifically the ability to place buy/sell orders (`scripts/snaptrade_order.py`) and the instruction in `SKILL.md` for the AI agent to set up a cron job for daily reports. While these actions align with the stated purpose of a financial portfolio management skill, they represent significant power (financial transactions, persistence) that, if misused by a compromised or vulnerable AI agent (e.g., via shell injection from user input or prompt injection), could lead to severe consequences. There is no evidence of intentional malicious design within the skill's code or instructions, such as data exfiltration to unauthorized endpoints or stealthy backdoors, but the inherent risk of these capabilities warrants a 'suspicious' classification.