Trade

Swap or trade tokens on Base network. Use when you or the user want to trade, swap, exchange, buy, sell, or convert between tokens like USDC, ETH, and WETH. Covers phrases like "buy ETH", "sell ETH for USDC", "convert USDC to ETH", "get some ETH".

This skill does what it says (trades tokens) but it executes an unpinned npm package at runtime (npx awal@latest) and relies on a wallet authentication step that is not described. Before installing or using it: verify the `awal` CLI's source and maintainers, prefer a pinned version rather than @latest, inspect the package code (or its published repository) to see how it handles keys and approvals, and avoid entering private keys into prompts unless you trust the package. If possible, run trades from an isolated/hard-limited wallet (small funds) or ask the author for a versioned, auditable integration that documents exactly how authentication and signing are performed.

Type: OpenClaw Skill Name: trade Version: 0.1.0 The skill is designed for a legitimate purpose (token trading) and includes a security instruction to prevent shell variable expansion. However, it relies on the `npx awal@latest` external package, introducing a supply chain risk. More critically, the `allowed-tools` in `SKILL.md` use broad wildcards (`Bash(npx awal@latest trade *)`), permitting the agent to pass arbitrary arguments to the `awal` command. This creates a vulnerability where potential command injection flaws within the `awal` tool itself could be exploited if an attacker crafts malicious inputs, even though the skill itself does not explicitly instruct the agent to perform malicious actions.