by 安全扫描
OpenClaw
安全
high confidenceThe skill's code, runtime instructions, and external requirements are coherent with a DeFi trading bot: it scans market APIs, runs a local risk gate, and calls a CLI (Bankr) to execute trades — it does not ask for unrelated credentials or hidden endpoints.
评估建议
This skill appears internally consistent with an automated DeFi trading bot, but it can execute real trades via the Bankr CLI. Before installing or running:
- Review and vet the Bankr CLI (npm package and https://bankr.bot). Only install trusted CLIs and understand where they store keys (~/.bankr/config.json).
- Start in dry-run / paper-trade mode (configs default to dry_run=true) and test with small amounts or no funds.
- Inspect the included scripts (you already have them) for unexpected netwo...详细分析 ▾
✓ 用途与能力
Name/description match the included scripts and behavior: token scanner, risk manager, trade executor, and review loop. Required capabilities (calling CoinGecko, reading/writing local trade logs, calling a DEX CLI) are consistent with an automated trading engine. No unrelated credentials or binaries are requested.
✓ 指令范围
SKILL.md instructs copying the provided scripts, creating a local config, installing/using the Bankr CLI, and running the scanner/risk checks/review. The instructions reference only local files (trading-config.json, trades/, reviews/) and expected external APIs (CoinGecko). There are no instructions to read arbitrary system files or exfiltrate data.
✓ 安装机制
This is an instruction-only skill with included Python scripts (no install spec). The skill expects the user to install the Bankr CLI separately (npm install -g @bankr/cli) per the README. That external install step is normal for a CLI-driven trading workflow and is not performed by the skill itself.
ℹ 凭证需求
The skill does not declare or require environment variables. It relies on the Bankr CLI for authentication (references ~/.bankr/config.json and bankr login). This is proportionate for a CLI-based trading bot, but it means the bot will operate using whatever wallet/API keys the Bankr CLI holds — review and restrict those credentials before enabling live trades.
✓ 持久化与权限
The skill does not request always:true and is user-invocable. It does not attempt to modify other skills or system-wide settings. It writes/read local logs and config files within the workspace (trades/, reviews/, trading-config.json), which is expected for this use case.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/13
Tested release. All scripts verified. Config defaults to dry-run. Missing config no longer crashes.
● 无害
安装命令
点击复制官方npx clawhub@latest install defi-trading-engine
镜像加速npx clawhub@latest install defi-trading-engine --registry https://cn.longxiaskill.com