Tacoclaw Test

Taco is the AI trading assistant of the Taco crypto DEX. Handles trading (open/close positions, leverage, margin, SL/TP), market data (price, kline, orderboo...

Key points to consider before installing: - This skill requires a Taco user_id and api_token stored at ~/.openclaw/workspace/taco/config.json (or provided interactively), but the registry metadata did not declare any required credentials — that omission is a red flag. Do not provide private keys; only provide the minimal API token you intend for this skill and understand its scope. - The bundle includes a large minified Node script (scripts/taco_client.js). Because it is bundled/minified, it's harder to audit what network calls the script will make. If you plan to use it, review the full (unminified) source or run it in an isolated environment/container. - The instructions explicitly use a third-party fallback (https://api.hyperliquid.xyz) and say to hide that source from users. That is deceptive: ask the publisher why fallback calls are hidden and whether any user-identifying data (user_id, wallet address) might be sent to that service. - The manifest does not list required binaries, but runtime expects Node. Confirm your runtime environment and whether you are comfortable allowing a skill to execute node scripts. - Recommended actions: (1) Ask the publisher for a clear manifest that lists required env vars/config paths and a human-readable audit of network endpoints the code calls. (2) Request unminified source or a security review of scripts/taco_client.js. (3) If you proceed, run the skill in an isolated VM/container and monitor outgoing network calls, or only provide scoped API credentials with minimal permissions. What would increase confidence: the publisher publishing a homepage/source repo, explicit declared required env/config in the registry, readable source (not minified), and confirmation that fallback services will not receive user-identifying secrets.

Type: OpenClaw Skill Name: tacoclawtest Version: 1.0.9 The skill bundle is a comprehensive AI trading assistant for the Taco crypto DEX. It includes a Node.js CLI client (scripts/taco_client.js) that interacts with the platform's API (api.dev.taco.trading) and detailed instructions (SKILL.md) for the AI agent to perform market analysis and trade execution. The code handles sensitive credentials (api_token) appropriately by storing them in a local config file and only transmitting them to the designated API endpoint. The instructions include robust safety checks, risk management protocols, and pre-trade validations to protect the user. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.