← 返回 Skills 市场
341
总下载
1
收藏
2
当前安装
3
版本数
在 OpenClaw 中安装
/install tinkclaw
功能描述
Financial market intelligence from TinkClaw. Real-time AI trading signals (BUY/SELL/HOLD), market regime detection, Signal Market bot competition with SHA-25...
安全使用建议
This skill appears to do what it says (fetch market signals from TinkClaw) and asks for a TinkClaw API key — that is reasonable. However: (1) the registry metadata does not list the env vars/binaries the SKILL.md and script require; verify the package metadata before installing. (2) The helper script reads TINKCLAW_API_URL (defaulting to tinkclaw.com) — do not set this to an untrusted host, because the agent will send your API key to whatever domain is configured. (3) The SKILL.md references a MARKET key, but the script doesn't use it for authenticated market endpoints (bug/inconsistency). Before installing: confirm the skill's origin (tinkclaw.com/docs), verify the creator, and prefer creating a dedicated API key with minimal privileges. If you proceed, do not reuse the same API key elsewhere; consider rate limits and that the skill will make outbound network calls to the TinkClaw domain. If you need higher assurance, ask the publisher to (a) fix registry metadata so required env vars and python3 are declared, (b) document or remove the TINKCLAW_API_URL override, and (c) ensure MARKET_KEY is properly used for /market endpoints.
功能分析
Type: OpenClaw Skill
Name: tinkclaw
Version: 1.2.0
The tinkclaw skill is a financial market intelligence tool that provides trading signals, market regime detection, and AI-driven analysis via the TinkClaw API. The Python helper script (scripts/tinkclaw.py) is well-structured, using standard libraries to perform authenticated requests to the documented endpoints at tinkclaw.com. There is no evidence of data exfiltration, malicious execution, obfuscation, or harmful prompt injection in the SKILL.md instructions.
能力评估
Purpose & Capability
The skill's name/description (real-time trading signals, regime detection, Signal Market) align with the included helper script and API reference. Requiring a TinkClaw API key (sk-tc-...) is coherent for this purpose. However, the registry metadata provided to OpenClaw lists no required env vars or binaries while SKILL.md and the script require python3 and a TINKCLAW_API_KEY — a metadata mismatch that should be corrected.
Instruction Scope
SKILL.md instructs the agent to call the TinkClaw API and to set TINKCLAW_API_KEY (and optionally TINKCLAW_MARKET_KEY). The helper script performs only HTTP requests to API endpoints under the configured API_BASE and prints JSON — it does not access arbitrary local files. Concerns: (1) the script reads TINKCLAW_API_URL (API_BASE) but SKILL.md does not document this env var; an attacker-controlled API_BASE could redirect all requests to an arbitrary host. (2) SKILL.md suggests a MARKET key, but the code never uses MARKET_KEY when calling /market endpoints (implementation bug), so instructions and code disagree.
Install Mechanism
No install spec; the skill is instruction + a small helper script. There are no downloaded archives or external installers in the package, so nothing is written to disk beyond the included files at install time.
Credentials
Requesting a TINKCLAW_API_KEY (and optionally a TINKCLAW_MARKET_KEY) is appropriate for this service. But the registry metadata omitted these required env vars and binaries, creating a mismatch. Additionally, the script supports TINKCLAW_API_URL (overriding the base URL) but this env var is undocumented — that increases risk if an attacker can set it. The skill will transmit whatever API key is present in the Authorization header to the configured API endpoint, so keys should be treated as sensitive.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and does not require system config paths or elevated privileges. Autonomous invocation is allowed (default) but that's expected for normal skills.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install tinkclaw - 安装完成后，直接呼叫该 Skill 的名称或使用
/tinkclaw触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.2.0
Signal Market: leaderboard, challenge, verify, feed commands. Full 21-endpoint API reference. NemoClaw spec compliance (version, homepage, primaryEnv, requires.env).
v1.1.0
62 symbols (up from 33), combo workflows (morning brief, deep dive, alpha scan, portfolio risk check), intent mapping, pre-action checklists, regime reference table, security philosophy, prompt injection guards, data integrity constraints
v1.0.0
Initial release — AI agent training ground for financial markets.
元数据
常见问题
TinkClaw 是什么？
Financial market intelligence from TinkClaw. Real-time AI trading signals (BUY/SELL/HOLD), market regime detection, Signal Market bot competition with SHA-25... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 341 次。
如何安装 TinkClaw？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install tinkclaw」即可一键安装，无需额外配置。
TinkClaw 是免费的吗？
是的，TinkClaw 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
TinkClaw 支持哪些平台？
TinkClaw 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 TinkClaw？
由 dieub（@dieub）开发并维护，当前版本 v1.2.0。
推荐 Skills