Vibe Trading

Professional finance research toolkit — backtesting (7 engines + benchmark comparison panel), factor analysis, options pricing, 72 finance skills, 29 multi-a...

This skill appears to do what it says, but it requires you to pip-install and run a third-party MCP server (vibe-trading-ai / vibe-trading-mcp). Before installing: - Verify the PyPI package and its author (view the project on PyPI/GitHub, inspect source code) — pip installs can run arbitrary code on your machine. - Prefer installing inside an isolated environment (virtualenv, container, or disposable VM) and test there first. - Review what the MCP server does: read its docs/source to confirm network endpoints it opens, data it logs, and whether it exfiltrates data. - Only provide optional API keys (TUSHARE, OPENAI, broker credentials) if you trust the package and limit their permissions where possible. - If you need stronger guarantees, run the backtests and file-processing steps locally with manual commands instead of registering the MCP server, or request a vetted binary/release signed by a known maintainer. If you can't inspect the package source or verify the maintainer, treat this skill as higher-risk and avoid installing it on sensitive machines.

Type: OpenClaw Skill Name: vibe-trading Version: 0.1.6 The vibe-trading bundle provides a comprehensive finance toolkit but includes high-risk capabilities such as arbitrary file system access (read_file, write_file) and network communication (web_search, read_url). It specifically targets sensitive financial data by requesting users to provide broker CSV exports for its 'Shadow Account' analysis. While these features are consistent with the stated goal of financial research, the combination of broad system access and the processing of private financial records via the vibe-trading-ai dependency presents a significant security risk without further inspection of the underlying package code.