FB thetanuts

Trade crypto options on Thetanuts Finance - orderbook fills, RFQ lifecycle, multi-strike structures, real-time WebSocket, wallet management, early settlement, referrer fees

Not recommendedlow grade F

ClawHub Agent Skills author: Goh Ee Sheng v1.5.4 MIT-0 30 files · 2 scripts body ≈ 18 749 tokens Open the sourceclawhub.ai↗ analyzed 4 d ago

As a process B 65/100 · Nearly there — weak spots: inputs and preconditions, execution cost, progress reporting

Procedure Infrastructuretype and topics are labelled automatically from the skill text

Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode

JSON

Technical rating

29/100

safety, quality, tests

Safety 60%: 0
Quality 40%: 73
Run on models: none yet

Process rating

65/100

Nearly there

Inputs and preconditions w 11: 0
Progress reporting w 2: 0
Execution cost w 6: 10

the three weakest of ten parameters · all ten

What is at stake

Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.

Risky intent medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The purpose itself is risky: wallets, browser password stores, offensive security. Even an honest implementation gives the agent access to things that cost money.

For the author

Explain in the description why the access is needed and how it is limited; add tests that show refusals on dangerous requests.

How to improve

The SKILL.md body is over 5,000 tokens: move reference detail into references/ and load it when needed.

For the model run — optional

Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 55

✓ No critical or high findings

Medium and low: 55

medium Risky intent intent-wallet-secrets README.md:73

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target

**⚠️ IMPORTANT**: Use a DEDICATED wallet for this integration. Never reuse your primary wallet seed phrase. Write your seed phrase on paper and store it offline (not in a text file, not in a chat, not

medium Risky intent intent-wallet-secrets README.md:120

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
`wallet-import.js`). The scripts intentionally refuse to accept a seed phrase
```
medium Risky intent intent-wallet-secrets README.md:193

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
| `import-wallet.ts` | Import existing wallet from seed phrase |
```
medium Risky intent intent-wallet-secrets README.md:202

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
(loaded from `~/.openclaw/wdk-mcp/.env`). Passing a seed phrase as a CLI
```
medium Risky intent intent-wallet-secrets scripts/import-wallet.ts:3

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
* Import an existing wallet using seed phrase.
```
medium Risky intent intent-wallet-secrets scripts/import-wallet.ts:113

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
// NOTE: We do NOT include the seed phrase in the output for import
```
medium Risky intent intent-wallet-secrets scripts/onboard.sh:70

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
# Wallet seed phrase (set by wallet-create.js or wallet-import.js)
```
medium Risky intent intent-wallet-secrets scripts/sign-message.ts:3

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
* Sign a message with wallet private key.
```
medium Risky intent intent-wallet-secrets scripts/wallet-create.js:3

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
* Create a new wallet with fresh BIP-39 seed phrase
```
medium Risky intent intent-wallet-secrets scripts/wallet-create.js:6

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
* Generates a new seed phrase and configures the wallet runtime
```
medium Risky intent intent-wallet-secrets scripts/wallet-create.js:80

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
// Generate new seed phrase (128 bits = 12 words)
```
medium Risky intent intent-wallet-secrets scripts/wallet-import.js:3

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
* Import existing wallet from seed phrase
```
medium Risky intent intent-wallet-secrets scripts/wallet-import.js:7

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
* Validates and imports an existing BIP-39 seed phrase
```
medium Risky intent intent-wallet-secrets scripts/wallet-import.js:110

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
// Read seed phrase
```
medium Risky intent intent-wallet-secrets scripts/wallet-import.js:134

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
// Validate seed phrase
```
medium Risky intent intent-wallet-secrets SKILL.md:116

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
- **LOCAL CUSTODY**: Your seed phrase stays on your machine. The agent never sends it anywhere.
```
medium Risky intent intent-wallet-secrets SKILL.md:137

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target
```
- Wallet custody stays LOCAL - your seed phrase never leaves your machine
```
low Secrets in code secret-high-entropy-token package-lock.json:87

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha5…cAz+ivBu…Lvw==",
```
detector
low Secrets in code secret-high-entropy-token package-lock.json:172

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha5…IxX/wd5n…MGF+pv6g…i2Z+Wnj9/KjGz…4Eg==",
```
detector
low Secrets in code secret-high-entropy-token package-lock.json:206

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha5…BQM/qZ3R+9TEU…es4+qu1b…BFA==",
```
detector
low Secrets in code secret-high-entropy-token package-lock.json:223

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha512-8mL/vh8q…uJP+ZcVY…AJW+m0Et…WzA==",
```
detector
low Secrets in code secret-high-entropy-token package-lock.json:240

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha5…NES+HiD4…TOe+/2rdn…PWn/r/aAw==",
```
detector
low Secrets in code secret-high-entropy-token README.md:89

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
- **USDC** (for PUT options) - `0x83…913`
```
detector
low Secrets in code secret-high-entropy-token README.md:174

High-entropy token-like string (may be an id, hash or a credential)
```
node scripts/wallet-balance.js --chain base-mainnet --index 0 --tokens 0x83…913
```
low Secrets in code secret-high-entropy-token README.md:208

High-entropy token-like string (may be an id, hash or a credential)
```
npx tsx scripts/approve-token.ts --token 0x83…913 \
```
low Secrets in code secret-high-entropy-token README.md:209

High-entropy token-like string (may be an id, hash or a credential)
```
--spender 0x1a…6e5 --amount 100 --wait
```
low Secrets in code secret-high-entropy-token README.md:214

High-entropy token-like string (may be an id, hash or a credential)
```
npx tsx scripts/approve-token.ts --token 0x83…913 \
```
low Secrets in code secret-high-entropy-token scripts/approve-token.ts:112

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
example: 'WDK_SEED="word1 word2 ... word12" npx tsx approve-token.ts --token 0x83…913 --spender 0x1a…6e5 --amount 100 --wait',
```
quoted
low Secrets in code secret-high-entropy-token scripts/approve-token.ts:114

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
USDC: '0x83…913',
```
quoted
low Secrets in code secret-high-entropy-token scripts/approve-token.ts:116

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
cbBTC: '0xcb…3Bf',
```
quoted
low Secrets in code secret-high-entropy-token scripts/approve-token.ts:119

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
'Thetanuts RFQ': '0x1a…6e5',
```
quoted
low Risky intent intent-wallet-secrets scripts/create-wallet.ts:121

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)
```
warning: 'SAVE YOUR SEED PHRASE SECURELY. Anyone with this phrase can access your funds.',
```
quoted
low Risky intent intent-wallet-secrets scripts/create-wallet.ts:124

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)
```
'Never share your seed phrase with anyone',
```
quoted
low Risky intent intent-wallet-secrets scripts/create-wallet.ts:125

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)
```
'Never enter your seed phrase on websites or apps you do not trust',
```
quoted
low Secrets in code secret-high-entropy-token scripts/fill-order.ts:21

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
'0x83…913': { symbol: 'USDC', decimals: 6 },
```
quoted
low Secrets in code secret-high-entropy-token scripts/fill-order.ts:23

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
'0xcb…3Bf': { symbol: 'cbBTC', decimals: 8 },
```
quoted
low Secrets in code secret-high-entropy-token scripts/get-balance.ts:19

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
'0x83…913': { symbol: 'USDC', decimals: 6 },
```
quoted
low Secrets in code secret-high-entropy-token scripts/get-balance.ts:21

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
'0xcb…3Bf': { symbol: 'cbBTC', decimals: 8 },
```
quoted
low Secrets in code secret-high-entropy-token scripts/get-balance.ts:63

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
USDC: '0x83…913',
```
quoted
low Secrets in code secret-high-entropy-token scripts/get-balance.ts:65

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
cbBTC: '0xcb…3Bf',
```
quoted
low Risky intent intent-wallet-secrets scripts/onboard.sh:186

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)
```
echo -e "${YELLOW}   Do NOT reuse your primary or personal wallet seed phrase.${NC}"
```
quoted
low Secrets in code secret-high-entropy-token scripts/send-transaction.ts:73

High-entropy token-like string (may be an id, hash or a credential) (placeholder value)
```
example: 'WDK_SEED="word1 word2 ... word12" npx tsx send-transaction.ts --to 0x1a…6e5 --data 0xb5…... --wait',
```
placeholder
low Secrets in code secret-high-entropy-token scripts/wallet-balance.js:29

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
'0x83…913': { symbol: 'USDC', decimals: 6, chains: ['base-mainnet'] },
```
quoted
low Secrets in code secret-high-entropy-token scripts/wallet-balance.js:31

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
'0xcb…3Bf': { symbol: 'cbBTC', decimals: 8, chains: ['base-mainnet'] },
```
quoted
low Secrets in code secret-high-entropy-token scripts/wallet-balance.js:33

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
'0xA0…B48': { symbol: 'USDC', decimals: 6, chains: ['ethereum-mainnet'] },
```
quoted
low Secrets in code secret-high-entropy-token scripts/wallet-balance.js:34

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
'0xdA…ec7': { symbol: 'USDT', decimals: 6, chains: ['ethereum-mainnet'] },
```
quoted
low Secrets in code secret-high-entropy-token scripts/wallet-balance.js:111

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
example: 'node wallet-balance.js --chain base-mainnet --tokens 0x83…913',
```
quoted
low Risky intent intent-wallet-secrets scripts/wallet-create.js:135

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)
```
'⚠️  SAVE THIS SEED PHRASE SECURELY!',
```
quoted
low Risky intent intent-wallet-secrets scripts/wallet-create.js:137

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)
```
'   - NEVER share this seed phrase with anyone',
```
quoted
low Risky intent intent-wallet-secrets scripts/wallet-import.js:138

Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)
```
message: 'Empty seed phrase provided',
```
quoted
low Secrets in code secret-high-entropy-token SKILL.md:675

High-entropy token-like string (may be an id, hash or a credential)
```
└─> node scripts/wallet-balance.js --chain base-mainnet --tokens 0x83…913
```
low Secrets in code secret-high-entropy-token SKILL.md:699

High-entropy token-like string (may be an id, hash or a credential)
```
└─> npx tsx scripts/approve-token.ts --token 0x83…913 --spender 0x81…B94 --amount <exact> --wait
```
low Secrets in code secret-high-entropy-token SKILL.md:942

High-entropy token-like string (may be an id, hash or a credential)
```
node scripts/wallet-balance.js --chain base-mainnet --tokens 0x83…913
```
low Secrets in code secret-high-entropy-token SKILL.md:1111

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
referrer: '0x92…567',
```
quoted
low Secrets in code secret-high-entropy-token SKILL.md:1124

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
'0x92…567'
```
quoted

Files scanned: 30. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

warning body-long SKILL.md body ≈ 18749 tokens (recommended < 5000); move details to references/
note frontmatter-key unknown frontmatter key "homepage"

Process rating: all ten parameters 65/100

0Inputs and preconditions. Does not say what the process needs to start
0Progress reporting. Says nothing while it works
10Execution cost. Instruction body is 18749 tokens: crowds the task out of the window
60Tools and files. Uses tools (bash, web, node) that frontmatter does not declare
60Result and completion. Output format stated, no completion criterion
70When it triggers. States when to use, but not when not to
100Steps. 146 steps
100Failures and branches. 11 branches, has a failure section
100Consistency. Name and required fields are in place
100Running it twice. Mutating operations check current state

medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
low 23 top-level sections: this looks like several domains in one skill
low The response is described with custom markup (4 tags): a typed call is more reliable

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

+5Description has no quoted example phrases that should trigger the skill
+4Description does not say when NOT to use the skill (false activations)
-35 of 22 scripts are never mentioned in SKILL.md
+1No license
+2Single-language instructions
+3Description length 172: enough signal without eating the budget
+4Structure: 109 headings
+3Step-by-step instructions: 146 items
+3Output format is stated explicitly
+4Has examples (51 code blocks)

Quality base 70; lint remarks subtract, signals add up to 100. Result: 73.

External checks

ClawHub: suspicious

This appears to be a real crypto trading skill, but it needs review because it stores wallet seeds in plaintext, can broadcast wallet transactions, and includes an unsafe remote updater.

LLM: suspicious (high) · 28 May 2026

Tests

— no evals.json

— no spec.yaml

— not run on models

Files · 30

CLAUDE.md 4K
manifest.json 2K
package-lock.json 193K
package.json 1K
README.md 10K
scripts/approve-token.ts 12K
scripts/build-rfq.ts 11K
scripts/calculate-payout.ts 5K
scripts/check-orderbook.ts 12K
scripts/check-rfq-fill.ts 7K
scripts/create-wallet.ts 4K
scripts/fetch-orders.ts 3K
scripts/fill-order.ts 11K
scripts/get-balance.ts 7K
scripts/get-mm-pricing.ts 3K
scripts/get-positions.ts 3K
scripts/get-prices.ts 1K
scripts/import-wallet.ts 4K
scripts/lib/load-seed.ts 2K
scripts/onboard.sh 5K
scripts/send-transaction.ts 7K
scripts/sign-message.ts 4K
scripts/update.sh 6K
scripts/wallet-balance.js 8K
scripts/wallet-create.js 4K
scripts/wallet-discover.js 4K
scripts/wallet-import.js 5K
scripts/wallet-select.js 6K
skill-card.md 3K
SKILL.md 81K

When to use

| Structure | Market View | Risk Level | Risk/Reward | Best For | |-----------|-------------|------------|-------------|----------| | **PUT** | Bearish | HIGH | Large profit (up to strike - premium), lose premium | Strong downside conviction | | **CALL** | Bullish | HIGH | Unlimited profit, lose premium | Strong upside conviction | | **PUT_SPREAD** | Moderately bearish | MEDIUM | Capped profit/loss | Cheaper than vanilla put | | **CALL_SPREAD** | Moderately bullish | MEDIUM | Capped profit/loss

Frontmatter

homepage: https://github.com/Thetanuts-Finance/thetanuts-sdk

user-invocable: true

metadata: {"openclaw":{"emoji":"📈","install":[{"type":"node","package":"."}]}}

Dates

In catalog since 1 May 2026

Updated in catalog 25 May 2026

First seen here 8 Sept 2026

Last analysis 11 Sept 2026, 02:06 UTC

Last seen in crawl 12 h ago

Score history

Date		Score	Safety	Qual.
8 Sept 2026	F	29	0	73