Self-learning system for crypto trading. Logs trades with full context (indicators, market conditions), analyzes patterns of wins/losses, and auto-updates trading rules. Use to log trades, analyze performance, identify what works/fails, and continuously improve trading accuracy.
Security Analysis
medium confidenceThe skill's code mostly matches its stated purpose (local trade logging, analysis, and rule generation), but there are inconsistencies and a potentially impactful capability (writing arbitrary MEMORY.md) that you should review before installing.
The package implements local trade logging, analysis, rule generation, and a memory-update feature which aligns with the 'self-learning' description. However the manifest/SKILL.md declares 'jq' as a required binary while none of the provided Python scripts call jq. The SKILL.md references a weekly_review.py script that is not present in the file manifest (missing file). These are inconsistencies (likely sloppy packaging) but not themselves malicious.
Runtime instructions direct the agent/user to run local Python scripts that read/write files under the skill's data directory and to call update_memory.py with an arbitrary --memory-path. update_memory.py will open, modify and overwrite whatever file path you provide (commonly agent MEMORY.md), thereby injecting auto-generated 'learned rules' into agent memory. The instructions also mention a weekly_review.py (not included). There are no network calls in the scripts and no access to other system credentials, but the ability to append content into an agent memory file can materially change agent behavior and should be treated as a high-impact action.
No install spec is provided (instruction-only with local Python scripts), so nothing arbitrary will be downloaded or installed by the registry. This is low-risk. Note: metadata lists 'jq' as required but the code doesn't use it—remove or correct this requirement.
The skill requests no environment variables or external credentials. All data is read/written to local files (data/trades.json and data/learned_rules.json). This is proportionate to the stated purpose.
The skill does not request always:true and does not modify other skills' configs. However, update_memory.py intentionally writes to an arbitrary MEMORY.md path supplied by the user. That gives the skill the ability to inject content into an agent's memory/persistent configuration if the user points it there — a normal feature for this use-case but a behavioral privilege that can influence agent decisions.
Guidance
This skill appears to implement the advertised local trade-logging and analysis features, but review these before installing or running it: - Missing and unnecessary items: SKILL.md references weekly_review.py which is not present; metadata requires jq but none of the scripts call it. These are packaging issues — ask the publisher to correct them or remove the jq requirement. - HIGH-IMPACT action: update_memory.py will overwrite whatever file you point it at. Do NOT pass your real agent MEMORY.md, credentials file, or other sensitive files without first inspecting generated output. Instead: run generate_rules.py, inspect data/learned_rules.json, use update_memory.py --dry-run to preview changes, and back up the target MEMORY.md before writing. - Local-only behavior: the code contains no network calls or secret-exfiltration code; trades and generated rules are saved locally under data/. Still, treat any tool that writes to agent memory as trusted—review rules it would add to avoid unexpected automation changes. - Operational advice: run the scripts in an isolated environment or with a backup of your agent memory, inspect learned_rules.json before applying, and correct/remove the jq requirement. If you rely on a 'weekly review' feature, request the missing script from the author or avoid following that step until it is provided. Given these inconsistencies and the write-to-memory capability (which is powerful but could be legitimate), I rate the package as 'suspicious' pending the small fixes and extra user checks above.
Latest Release
v1.0.0
Self-learning system for crypto trading. Logs trades, analyzes patterns, generates rules, and auto-updates agent memory for continuous improvement.
Popular Skills
Published by @totaleasy on ClawHub
