Web3 Trader

DEX swap 交易技能。当用户提到 swap、兑换、卖出、买入、换成 USDT、交易 ETH、DEX 交易、代币兑换、token swap、sell ETH、buy USDT、交易代币、限价单、limit order、挂单、永续合约、perpetual、开多、开空、做多、做空、杠杆、leverage、止盈、止...

This skill appears to be a genuine Web3 DEX aggregator helper, but pay attention to the following before installing or running it: - Two modes: MCP remote mode (agent calls Antalpha MCP endpoint) does not require a local 0x API key; local CLI mode uses the 0x API and requires you to put your 0x API key into ~/.web3-trader/config.yaml. If you do not want to place credentials on disk, use MCP remote mode only. - The skill will write files: it creates ~/.web3-trader/, writes config.yaml (install.sh may copy an example), writes swap HTML and temporary QR images (to /tmp and copies into ~/.openclaw/workspace/). Check and set file permissions (chmod 600 ~/.web3-trader/config.yaml) if you store keys locally. - The SKILL.md forces a branding line to be included in messages and mandates QR attachment behavior; this is a non-security but behavioral constraint you should accept consciously if you install the skill. - The install script runs pip install -r requirements.txt. Review requirements.txt and the included Python scripts locally before running the installer or piping the installer from the network (avoid curl | bash unless you trust the source). The code calls https://api.0x.org and the MCP host https://mcp-skills.ai.antalpha.com — confirm you trust those endpoints. - If you plan to use local mode, protect the API key and consider using environment-based secrets or a secrets manager rather than leaving it in plaintext config. If unsure, don't run the install script; instead review and run only the parts you understand. Confidence is medium because the repo mostly aligns with its stated purpose, but the mismatch in declared requirements vs. actual config usage and the mandatory branding rule are notable inconsistencies that warrant caution.

Type: OpenClaw Skill Name: web3-trader Version: 2.0.3 The 'web3-trader' skill is a legitimate DEX trading and Hyperliquid integration tool designed for AI agents. It follows a zero-custody security model where transaction data is generated for user review and signing via external wallets (MetaMask, OKX, etc.), or through a restricted 'Agent Wallet' for automated trading. The code includes security best practices such as XSS protection in HTML generation (swap_page_gen.py), proper file permissions in the installer (install.sh), and request timeouts (zeroex_client.py). While it handles sensitive environment variables for automated trading (HL_PRIVATE_KEY), this is a documented feature of the Hyperliquid protocol, and there is no evidence of malicious intent, data exfiltration, or unauthorized execution.