技能详情（站内镜像，无评论）
作者：Dan Repaci @ahuserious
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v0.1.0
统计：⭐ 1 · 263 · 0 current installs · 0 all-time installs
⭐ 1
安装量（当前） 0
🛡 VirusTotal ：良性 · OpenClaw ：可疑
Package：ahuserious/nautilus-trader
安全扫描（ClawHub）
- VirusTotal ：良性
- OpenClaw ：可疑
OpenClaw 评估
The skill's stated purpose (trading/backtesting) matches the included code and instructions, but there are important inconsistencies: it asks for a raw Hyperliquid private key and bundles executable patch code while declaring no required credentials or installs, and the SKILL.md contains a detected unicode-control-chars injection signal — review carefully before use.
目的
Name/description (NautilusTrader + Hyperliquid live trading) is consistent with the code and docs included. However, the skill metadata declares no required environment variables or credentials while the runtime instructions explicitly require HYPERLIQUID_PK (private key) and HYPERLIQUID_VAULT. That mismatch is incoherent and reduces transparency about what secrets the skill needs.
说明范围
SKILL.md instructs the user/agent to import a local patch module (hyperliquid_patch) before importing NautilusTrader, create a .env containing a raw private key, and to run live-trading and leverage-setting scripts. Those runtime instructions cause the agent to execute bundled Python code that will use a sensitive private key; the skill instructions access sensitive environment variables that were not declared in the registry metadata. No inst…
安装机制
There is no install spec (instruction-only), which is lower risk than arbitrary downloads. The SKILL.md recommends pip installing nautilus_trader and hyperliquid-python-sdk from PyPI — expected for this purpose. The skill does bundle three Python modules (hyperliquid_patch.py, live_trading.py, set_leverage.py) that the agent may import and execute; bundling executable code without an explicit install step or provenance is worth scrutiny.
证书
The runtime instructions require HYPERLIQUID_PK (a raw private key) and HYPERLIQUID_VAULT; asking for a private key is proportionate to live trading but highly sensitive. The skill metadata did not declare any required env vars or a primary credential, creating an opacity problem. There are no other unrelated credentials, but the absence of declared secrets in registry metadata while instructing to provide them is a red flag.
持久
Skill flags: always=false and model invocation enabled (normal). The skill does not request permanent 'always' presence or system-level configuration changes in the provided materials. Autonomous invocation is allowed by default — combine that with the private-key usage only if you plan to let the agent act on its own with real funds.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Nautilus Trader」。简介：NautilusTrader algorithmic trading platform for strategy development and live t…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/ahuserious/nautilus-trader/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。