Trade History — 技能工具
v1.0.0Read and display recent trade history from local JSONL log file. Use when asked about past trades, trade recap, performance review, or to list recorded signals.
0· 417·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill claims to read a local trades.jsonl but its runtime instructions call an external Python script and a hard-coded user path that are not included in the skill bundle, creating a mismatch and execution risk.
评估建议
Do not run this skill until you verify the referenced Python script and the log path. Specifically: (1) Inspect the file ~/.npm-global/lib/node_modules/openclaw/skills/trade-history/read.py — do not execute it if you cannot review its contents; (2) Confirm or change the hard-coded log path (/home/windows_11/...) to a location you control, or require the skill accept a user-specified path; (3) Prefer a skill that includes its small read script in the package so you can review the code before exec...详细分析 ▾
ℹ 用途与能力
Stated purpose (read/display local JSONL trade log) is plausible and the only declared runtime dependency is python3, which is proportional. However the SKILL.md hard-codes a specific log location (/home/windows_11/.openclaw/...) and a path to a read.py under ~/.npm-global/lib/node_modules/openclaw/skills/trade-history/read.py that is not part of this skill package — that is inconsistent with an instruction-only skill which should either operate on files already present or include the small script it needs.
⚠ 指令范围
The instructions tell the agent to execute a local Python script at a specific global path. The skill bundle contains no code to review, so the actual behavior of that script is unknown — it could read only the trades file or perform arbitrary actions. The SKILL.md also embeds a user-specific absolute log path rather than a configurable or relative path, limiting portability and raising the chance of unintended file access.
ℹ 安装机制
No install spec (instruction-only) is lower risk in general, but here it's problematic: the instructions assume a particular script is already installed under ~/.npm-global/lib/node_modules/... even though the registry package includes no files. That implicit dependency makes behavior environment-dependent and unverifiable.
⚠ 凭证需求
The skill requests no environment variables or credentials, which is appropriate. However, it references a hard-coded home-directory path and a global npm path; executing an unknown script with access to the filesystem without explicit bounds is disproportionate to the simple task of reading a JSONL file. The SKILL.md's guarantee (read-only, never modify) cannot be verified from the available materials.
✓ 持久化与权限
The skill does not request 'always: true' and is user-invocable only; it does not request persistent privileges or modify other skills. Autonomous invocation remains possible (platform default) but is not combined here with elevated privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/23
Initial release: Read and display recent trade history from a local JSONL log file. - Reads trade events from a local trades.jsonl file and displays them in reverse chronological order. - Supports filtering trades by symbol and limiting the number of results (default 20). - Presents each trade with details: symbol, side, entry, stop loss, take profit, note, and timestamp. - Returns concise, structured JSON output including total trade count and items list. - Handles missing log files gracefully by returning an empty result without errors. - Read-only access; never modifies or deletes the log file.
● 无害
安装命令 点击复制
官方npx clawhub@latest install trade-history
镜像加速npx clawhub@latest install trade-history --registry https://cn.clawhub-mirror.com
技能文档
# Trade History Read and display recorded trade events from the local trades.jsonl log file, with optional filtering by symbol and configurable limit.
When to Use
- User asks: "tampilkan trade history"
- User asks: "trade apa saja yang sudah dicatat?"
- User asks: "recap trade BTC terakhir"
- User asks: "lihat 10 trade terakhir"
- User asks: "ada berapa trade yang tersimpan?"
How It Works
This skill runs a local Python script that:- Reads the local trades.jsonl file line by line.
- Parses each line as a JSON object.
- Filters by symbol if specified.
- Sorts results newest first (reverse chronological).
- Returns up to N records (default 20).
- Returns a JSON object with count and items array.
Workflow
Step 1 — Run the read script via bash tool: python3 ~/.npm-global/lib/node_modules/openclaw/skills/trade-history/read.py Step 2 — Parse the JSON output (count + items array). Step 3 — Present the trade list to the user in a readable format:- Show each trade: symbol, side, entry, sl, tp, note, timestamp
- Mention total count
- Newest trades first
Optional Arguments
Run with JSON args to filter or limit results: python3 ~/.npm-global/lib/node_modules/openclaw/skills/trade-history/read.py '{"limit": 10, "symbol": "BTCUSDT"}' Supported args:- limit: number of trades to return (default 20)
- symbol: filter by trading pair (e.g. BTCUSDT)
Output Format
{ "count": 3, "items": [ { "symbol": "BTCUSDT", "side": "BUY", "entry": 94500, "sl": 94000, "tp": 95500, "note": "sweep+fvg signal", "source": "btc-analyzer", "ts": "2026-02-23T00:00:00Z" } ] }Log File Location
/home/windows_11/.openclaw/polymarket-workspace/trades.jsonlError Handling
If log file does not exist yet: {"count": 0, "items": []} No error is thrown — returns empty result gracefully.Guardrails
- Always run the script — never fabricate trade history.
- If file is missing, return empty list gracefully without error.
- Output must be JSON only from the script.
- Always display newest trades first (reverse chronological order).
- Never delete or modify the log file — read only.
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制