The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires the user to provide and store highly sensitive credentials as environment variables, including exchange API secrets (BINANCE_API_SECRET, OKX_API_SECRET, BITGET_API_SECRET), passphrases (OKX_PASSPHRASE, BITGET_PASSPHRASE), and most critically, cryptocurrency private keys (POLYMARKET_PRIVATE_KEY, GMGN_PRIVATE_KEY). Handling raw private keys is an extremely high-risk practice.
[EXTERNAL_DOWNLOADS]: The installation instructions direct the user to download a zip archive from a third-party domain (https://www.openclawby.com/clawby-data.zip) or clone a repository from an untrusted GitHub account (https://github.com/openclawby/openclawby-skills.git). These sources are not recognized as trusted organizations or well-known services.
[REMOTE_CODE_EXECUTION]: The skill facilitates the download and local execution of scripts from an external, untrusted source. The ZIP file and GitHub repository contain Python executable files (e.g., binance_connector.py) that are subsequently executed by the user or agent.
[DATA_EXFILTRATION]: All data queries are routed through a central relay API (https://api.openclawby.com/api/relay). The CLAWBY_API_KEY is sent in the headers of every request. While the skill claims trade execution is local, the presence of network capabilities alongside the handling of sensitive private keys creates a high-risk surface for potential data exfiltration.
[PERSISTENCE]: The documentation encourages users to add export commands for their API keys and private keys to shell configuration files like ~/.bashrc or ~/.zshrc. This ensures the sensitive credentials persist across sessions but also leaves them stored in plain text in a standard location often targeted by malicious scripts.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from various external sources, creating a vulnerability surface for indirect prompt injection.
Ingestion points: Real-time social media data from X (Twitter) and Facebook, on-chain metrics, and DEX pair information from the blockchain.
Boundary markers: None identified in the provided instructions; there are no clear delimiters or warnings to the agent to ignore instructions embedded in the fetched data.
Capability inventory: The skill possesses significant capabilities, including executing trades on multiple crypto exchanges and prediction markets, writing to the local filesystem (local/config.json, local/api_keys.enc), and performing network operations.
Sanitization: There is no evidence of sanitization or filtering of the external social media or on-chain content before it is processed by the agent.
[DYNAMIC_EXECUTION]: The skill includes a self-update mechanism that checks a remote version and applies changes. It also relies on the dynamic execution of local Python connectors (exec/*.py) which are part of the external download package.

openclawby-skills