📦 Alpaca Trading — 股票交易
v2.1.0通过 Alpaca REST API 使用 curl 快速交易美股、ETF、期权与加密货币，支持买/卖看涨看跌期权、备兑开仓、现金担保卖出、价差组合等全功能操作。
2· 2.2k·16 当前·17 累计
by @lacymorrow下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
可疑
high confidenceNULL
评估建议
This skill is functionally coherent: it contains a small shell wrapper that uses your Alpaca API key and secret to call Alpaca endpoints. However the registry metadata incorrectly omits the required environment variables and required binaries (curl/jq), and the source/homepage is not clearly provided — both are red flags you should consider before installing. If you decide to proceed:
- Only provide paper/trading-sandbox API keys (not your live production keys) until you trust the author. Rotate...详细分析 ▾
✓ 用途与能力
The SKILL.md, README, references, and scripts/alpaca.sh consistently implement an Alpaca REST API wrapper for trading and market data. The requested capabilities (orders, positions, market data, options) match the stated purpose.
✓ 指令范围
The runtime instructions are narrowly scoped to calling Alpaca endpoints via the included scripts/alpaca.sh wrapper and to sourcing the script from the skill directory. The script requires APCA_API_KEY_ID and APCA_API_SECRET_KEY and uses them only in HTTP headers to call Alpaca endpoints (expected for a trading integration). There are no instructions to read unrelated system files or exfiltrate data to third-party endpoints.
✓ 安装机制
No install spec; the skill is instruction-only plus a small shell script included in the bundle. No downloads or archive extraction are present. This is low risk from installation mechanics.
⚠ 凭证需求
The SKILL.md and scripts require Alpaca API keys (APCA_API_KEY_ID and APCA_API_SECRET_KEY) and expect curl and optionally jq/python. However the registry metadata lists 'required env vars: none' and 'required binaries: none' — this mismatch is suspicious. Requesting Alpaca API keys is proportionate for trading functionality, but the developer registry should have declared these credentials. Additionally the skill can place live trades if APCA_API_BASE_URL is set to the live endpoint; the manifest notes paper by default but source is unknown. Use of full trading credentials carries high risk if the skill is untrusted.
✓ 持久化与权限
always:false and default autonomous invocation settings are normal. The skill does not request system-wide configuration or modify other skills. However autonomous invocation combined with trading credentials means the agent could place orders without additional manual steps if not properly gated by the platform — consider limiting invocation or using only paper keys.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.1.02026/2/8
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install alpaca-trading
镜像加速npx clawhub@latest install alpaca-trading --registry https://cn.longxiaskill.com