UnifAI Trading Suite

AI-powered trading insights suite: prediction markets (Polymarket/Kalshi) and social sentiment signals powered by UnifAI.

What to check before installing or running this skill: - Do not paste high-privilege or wallet/private-key secrets. The code and docs reference UnifAI toolkit actions and Polymarket/Kalshi trade APIs (including limit/market order actions), so supplying full trading credentials or private keys could enable the agent to execute trades. - Verify which exact environment variable names the runtime uses. The SKILL.md frontmatter, individual skill SKILL.md files, and code are inconsistent (UNIFAI_API_KEY vs UNIFAI_AGENT_API_KEY vs UNIFAI_TOOLKIT_API_KEY). Only set the env vars the code explicitly checks for (search the repository for os.getenv usages) and prefer read-only API keys where possible. - Inspect trading_agent.py and any UnifAI toolkit integration before running. Look for any methods that call execute/placement functions, web3 account signing, or call UnifAI tools that have order/trade actions. If you only want read-only analysis, ensure those execution paths are disabled or you provide restricted credentials. - Run in a sandboxed environment (VM/container) and use ephemeral/restricted API keys. If you test, avoid using real funds or privileged keys; prefer read-only or limited-scope keys. - Confirm provenance: the registry lists a GitHub homepage but owner info is unknown. Review the upstream repository (https://github.com/zbruceli/trading) and check commits, contributors, and issues to gain confidence. - If you plan to trust this skill in production or for autonomous use, ask the maintainer for clear documentation about what operations are purely read-only versus which require toolkit keys and can perform stateful actions. Consider an audit of code paths that call external APIs, web3 signing, or UnifAI tool calls before enabling autonomous invocation.

Type: OpenClaw Skill Name: unifai-trading-suite Version: 1.0.0 The skill bundle is classified as suspicious due to the presence of high-risk capabilities, specifically the `execute_trade` action in `src/toolkits/trading_toolkit.py` (even as a placeholder) and the `web3` dependency for on-chain analysis. While these are aligned with the stated purpose of an AI trading agent, they represent powerful functionalities that could lead to financial transactions or blockchain interactions if fully implemented and exposed without stringent safeguards. Additionally, the FastAPI server in `src/api/server.py` uses `allow_origins=['*']` for CORS, which is a broad permission, though common for development. There is no clear evidence of intentional malicious behavior like data exfiltration or persistence.