📦 Gekko Strategist — DeFi策略大脑
v1.0.0AI驱动的DeFi策略开发智能体，可依据市场行情、风险偏好与资金配置目标，设计、回测、调优并评估收益耕作策略，是Gekko系统的核心决策中枢。
1· 1.2k·3 当前·3 累计
by @gekkoai001下载技能包
最后更新
2026/3/1
安全扫描
OpenClaw
可疑
medium confidenceThe skill is mostly an instruction-only wrapper that sends strategy data to a remote API, but has unexplained requirements (Node, RPC/historical data) and will transmit user-provided financial inputs to an external endpoint with no authentication or provenance — proceed only after verifying the endpoint and data usage policies.
评估建议
This skill is a thin wrapper that sends your strategy data to a remote API (https://gekkoterminal.ai/api/a2a?agent=strategist). Before installing or using it: 1) Verify the operator and endpoint — who runs gekkoterminal.ai and do they publish a privacy / data retention policy? 2) Confirm authentication requirements — why does the skill show no API key or auth step? Avoid sending API keys, wallet private keys, seed phrases, or any personally identifying info. 3) Clarify the 'Node' / 'Base RPC / h...详细分析 ▾
⚠ 用途与能力
The skill's stated purpose is to design/backtest/adapt strategies, which can reasonably be implemented by a remote service. However the manifest requires the 'node' binary even though there is no code in the package that would need it. The SKILL.md also lists 'Access to Base network RPC' and 'Historical data access' as requirements, but the runtime instructions show all requests being made to the external API endpoint (https://gekkoterminal.ai/api/a2a?agent=strategist) with no explanation why local RPC or Node are necessary. This mismatch suggests either sloppy packaging or unclear trust boundaries.
⚠ 指令范围
All runtime examples instruct the agent to POST potentially sensitive strategy and capital data to a third-party API. The skill does not document any authentication, terms of service, or data retention policy for that endpoint. While sending strategy parameters is plausible for this purpose, the instructions give the agent no restrictions on what it may include (user identifiers, account balances, trade secrets) and no guidance to avoid sending private keys or wallet secrets. The agent would therefore be in a position to exfiltrate sensitive financial data to an external domain if not constrained.
✓ 安装机制
This is an instruction-only skill with no install spec and no packaged code. That minimizes on-disk risk (nothing is downloaded or executed by an install step).
⚠ 凭证需求
The skill declares no required environment variables or credentials, which is consistent with the examples, but also lists non-declarative requirements (Base RPC access, historical data). It is unclear whether the remote API performs backtests itself or expects the agent/user to supply RPC endpoints or datasets. The declared required binary 'node' is unnecessary for an instruction-only skill and is disproportionate unless additional local tooling is expected. Absence of any authentication requirement for the remote API is a potential privacy/security concern.
✓ 持久化与权限
The skill does not request persistent presence (always:false) and does not include install or config write operations. It does not request system-wide privileges or modify other skills' config.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/8
Major update: Gekko has been rebranded and refocused from portfolio management to strategy development. - Renamed from "gekko-portfolio-manager" to "gekko-strategist" - Now focuses on designing, backtesting, adapting, and evaluating DeFi yield farming strategies rather than direct portfolio allocation - New core commands: develop_strategy, backtest_strategy, adapt_strategy, and evaluate_strategies - Previous features like direct market analysis and vault yield optimization have been removed - API endpoint and metadata updated to reflect the new strategist focus and agent ID - Security model clarified: strategy suggestions only, no execution without user consent
● 无害
安装命令
点击复制官方npx clawhub@latest install gekko-strategist
镜像加速npx clawhub@latest install gekko-strategist --registry https://cn.longxiaskill.com