TradeMemory Protocol

AI trading memory for MT5/forex traders. Record every trade, discover patterns, and get AI-powered reflections with automatic strategy adjustments. The only...

This skill is coherent with its stated purpose, but take these precautions before installing or running it: 1) Review the tradememory-protocol package code (server/reflection logic) on PyPI/GitHub before pip installing and before running the server. 2) Only provide MT5 credentials if you understand they will be stored in a local .env file and used to connect to your MT5 terminal; the setup prints account info locally during verification. 3) Do not set ANTHROPIC_API_KEY unless you are willing to send (allegedly anonymized) trading-pattern data to Anthropic — audit what is sent. 4) Run installation and server in an isolated environment (virtualenv/container) and avoid running as root. 5) Note MT5 Python API usage is Windows-specific; on macOS/Linux you must use manual recording, the REST API, or your own sync script. Review the GitHub repo and package release provenance if you need higher assurance.

Type: OpenClaw Skill Name: tradememory Version: 0.3.2 The skill is classified as suspicious due to its explicit capability to send sensitive trade data to an arbitrary remote endpoint configured via the `TRADEMEMORY_API` environment variable, as documented in `SKILL.md`. While the documentation advises users to only use endpoints they control, this represents a significant data exfiltration risk if misconfigured or if a user is tricked into using a malicious endpoint. Additionally, the skill sends 'anonymized trade patterns' to the Claude API via `ANTHROPIC_API_KEY` for reflection, which, while a stated purpose, involves sending user data to a third-party service. The setup scripts (`install.sh`, `setup_mt5.sh`) perform standard installation and repository cloning, and handle MT5 credentials locally without evidence of direct exfiltration within the provided files.