VBrokers Trading

VBrokers (华盛通 VCL HK) trading automation via OpenAPI Gateway running on localhost port 11111. Use when: setting up VBrokers or 华盛通 account access, authentica...

This skill appears to implement exactly what it claims: a local OpenAPI Gateway client for VBrokers trading. Before installing or running it, do the following: (1) Verify the local Gateway (华盛通OpenAPIGateway.app) you will connect to is the official application and actually running on 127.0.0.1:11111. (2) Inspect the bundled scripts (vbrokers_client.py) yourself — it contains a hardcoded AES key used to encrypt your trading password; confirm this matches vendor documentation or replace it with a secure/configurable key if appropriate. (3) Never hand your real account credentials to untrusted code — test with a demo/small order first. (4) Ensure pycryptodome is installed from a trusted source. The skill does not exfiltrate data to remote hosts, but because it can place/cancel real orders, treat it as high-impact: validate behavior in a safe environment before granting it access to live money.

Type: OpenClaw Skill Name: vbrokers-trading Version: 1.0.0 The skill bundle provides automated trading capabilities for VBrokers via a local gateway, which is a high-risk activity. It contains security vulnerabilities in `scripts/vbrokers_client.py`, including a hardcoded AES key (`AES_KEY_B64`) and the use of the weak AES-ECB encryption mode for trading passwords. While these flaws pose a risk of credential compromise if the key is not a generic API requirement, there is no evidence of intentional malicious behavior, backdoors, or data exfiltration to external endpoints.