Trading Signals Ws

Real-time crypto trading signal generator using WebSocket price feeds. Connects to Bybit (or any exchange) WebSocket, runs configurable strategies on live ca...

This skill appears to do what it claims: it connects to public exchange feeds, computes indicators, and posts alerts to Telegram. Before installing, (1) review config.py and do not put unrelated secrets into it; only provide TG_BOT_TOKEN and TG_CHAT_ID if you want alerts. (2) Run the bot as a dedicated, non-root user (do not deploy the example systemd unit with WorkingDirectory=/root), and run inside a virtualenv so dependencies are isolated. (3) Inspect the full signal_bot.py (especially any parts not visible in the truncated paste) to confirm it only contacts exchange public APIs and Telegram. (4) Be cautious about subscribing or sharing credentials with third-party services advertised in the README (tinyore.com) — they are separate from this code. (5) Keep your Telegram bot token private: anyone with it can send messages from your bot. If you plan to use exchange private endpoints later, only provide exchange API keys with minimal scopes and consider hardware isolation.

Type: OpenClaw Skill Name: trading-signals-ws Version: 1.3.0 The skill is classified as suspicious due to the inclusion of systemd deployment instructions in `SKILL.md` that establish persistence and suggest execution with elevated privileges (e.g., `WorkingDirectory=/root/signals`). While intended for legitimate deployment, this capability could be leveraged for malicious purposes if the agent or the script were compromised. Additionally, `SKILL.md` includes instructions for external network calls to `api.tinyore.com` for an optional service, and `scripts/signal_bot.py` uses `parse_mode='HTML'` for Telegram messages, which, while not directly exploitable here, is a general vulnerability pattern if message content were to become user-controlled.