首页 › 龙虾技能列表 › Leapcat Skills

Leapcat Skills

v0.1.1

Trade stocks, subscribe to IPOs, manage wallet, complete KYC, and access real-time market data via AI agent. 7 skills for the Leapcat platform.

0· 54·0 当前·0 累计
by @raymondxu813-finance·MIT-0
下载技能包
License
MIT-0
最后更新
2026/4/1
安全扫描
VirusTotal
可疑
查看报告
OpenClaw
可疑
medium confidence
The skill's purpose and commands align with a trading/KYC/wallet CLI, but it instructs the agent to run npx to download and execute an npm package at runtime and references local token and file paths — a proportional-but-noticeable risk that the user should review before enabling.
评估建议
This skill appears to be what it says (a CLI wrapper for Leapcat trading, KYC, wallet, and market data) but it relies on running 'npx leapcat@0.1.1' at runtime. npx will fetch and execute package code from npm — even though the version is pinned, the package itself is not included here for review. Before installing/using: 1) Review the npm package and its GitHub repo (the SKILL.md points to them) to inspect the code that will run. 2) Avoid running CLI commands that expose sensitive local files u...
详细分析 ▾
✓ 用途与能力
Name, description, and the seven sub-skills (auth, kyc, market, trading, wallet, portfolio, ipo) match the commands shown. Required capabilities (Node.js, auth via email/OTP, local token storage) are consistent with a trading/finance CLI.
ℹ 指令范围
Runtime instructions are specific: they tell the agent to run npx leapcat@0.1.1 commands. The docs only upload local files when the user supplies explicit file paths, and they name the local token file (~/.config/leapcat/tokens.json). The instructions do not directly tell the agent to scan arbitrary local files, but they do cause the agent to execute CLI commands that may read or write those paths if invoked.
⚠ 安装机制
There is no declared install spec, but the SKILL.md requires running npx leapcat@0.1.1 which will fetch and execute code from the npm registry at runtime. Although the version is pinned (0.1.1), npx still runs external package code when invoked — this is a moderate supply-chain risk because the package code is not included for review here.
ℹ 凭证需求
The skill requests no environment variables (authentication uses email/OTP) which is proportionate. However the CLI stores JWT access/refresh tokens at ~/.config/leapcat/tokens.json; any agent-run commands could access that file. The skill does not ask for unrelated credentials, which is good, but the local token file is sensitive and worth protecting.
✓ 持久化与权限
always is false and the skill does not request system-wide configuration changes. The only persistent artifact named is the CLI's token file in the user's config directory; that behavior is expected for a remote-account CLI.
安全有层次，运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发，无需署名。

运行时依赖

无特殊依赖

版本

latestv0.1.12026/4/1

- Updated all quick start examples and documentation to use the version-pinned command `npx leapcat@0.1.1` instead of `npx leapcat@latest` - Added `homepage` field and a dedicated "Security & Provenance" section with links to GitHub and npm package, and details about version pinning and token/document handling - Clarified that commands are now version-pinned to improve security and prevent supply-chain drift - Added notes about KYC document uploads and authentication handling (no user credentials or env vars required)

● 可疑

安装命令 点击复制

官方npx clawhub@latest install leapcat
镜像加速npx clawhub@latest install leapcat --registry https://cn.clawhub-mirror.com

技能文档

A comprehensive set of 7 AI agent skills for the Leapcat platform. All commands use npx leapcat@0.1.1 — no global install needed, just Node.js 18+.

Available Skills

leapcat-auth

Login, logout, session management, token refresh, re-authentication, and trade password operations.

leapcat-kyc

KYC identity verification including document upload, personal info submission, agreements, and status polling.

leapcat-ipo

Browse IPO projects, estimate costs, subscribe, cancel, and monitor subscription status.

leapcat-trading

Place buy/sell stock orders (limit/market), monitor order status, and cancel pending orders.

leapcat-wallet

Check balance, get deposit address, initiate withdrawals, view debt status, and fund activity history.

leapcat-portfolio

View portfolio overview and individual stock positions with unrealized P&L.

leapcat-market

Real-time stock quotes, K-line charts, market indices, stock search, exchange rates, and fee schedules. No authentication required.

Quick Start

Check market data (no login needed):

npx leapcat@0.1.1 market quote --symbol 00700.HK --json
npx leapcat@0.1.1 market indices --json

Login to access authenticated features:

npx leapcat@0.1.1 auth login --email your@email.com --send-only --json
npx leapcat@0.1.1 auth login --email your@email.com --otp-id  --otp-code  --json

Then use any skill:

npx leapcat@0.1.1 wallet balance --json
npx leapcat@0.1.1 portfolio positions --json
npx leapcat@0.1.1 ipo projects --json

Notes

  • All commands output JSON when using the --json flag
  • Session tokens are stored locally at ~/.config/leapcat/tokens.json
  • Access tokens auto-refresh; re-login only needed after 30 days of inactivity
  • For sensitive operations (withdrawals), run npx leapcat@0.1.1 auth reauth --json first

Security & Provenance

  • Source code: github.com/leapcat-ai/leapcat-skills
  • npm package: npmjs.com/package/leapcat
  • Version pinned: All commands use npx leapcat@0.1.1 (pinned, not @latest) to prevent supply-chain drift
  • Token storage: ~/.config/leapcat/tokens.json is created automatically after login; contains JWT access/refresh tokens, not user credentials
  • KYC documents: Only uploaded when the user explicitly provides file paths; the CLI does not scan or access local files automatically
  • No env vars required: Authentication is handled via email OTP, no API keys needed
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制

免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制

了解定制服务