CC kryptogo-meme-trader
Analyze and trade meme coins using KryptoGO's on-chain cluster analysis platform. Covers wallet clustering, address labels, accumulation/distribution detection, and automated swap execution via the Agent Trading API.
Analyze and trade meme coins using KryptoGO's on-chain cluster analysis platform.
As a process C 53/100 · Has gaps — weak spots: result and completion, when it triggers, inputs and preconditions
How to improve
- Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
- A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.
Guard findings · 37
✓ No critical or high findings
Medium and low: 37
-
low Secrets in code
secret-high-entropy-tokenexamples/trading-workflow.py:53High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)SOL_MINT = "So11…112"
fixturequoted -
low Secrets in code
secret-high-entropy-tokenreferences/api-reference.md:12High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)- Wrapped SOL mint: `So11…112`
quoted -
low Secrets in code
secret-high-entropy-tokenreferences/api-reference.md:686High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)"input_mint": "So11…112",
quoted -
low Secrets in code
secret-high-entropy-tokenreferences/api-reference.md:690High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)"wallet_address": "EQ7C…AUN"
quoted -
low Secrets in code
secret-high-entropy-tokenreferences/api-reference.md:716High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)"fee_payer": "EQ7C…AUN",
quoted -
low Secrets in code
secret-high-entropy-tokenreferences/api-reference.md:717High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)"signers": ["EQ7C…AUN"]
quoted -
low Exfiltration
read-dotenvreferences/autonomous-trading.md:61Reads a .env filesource ~/.openclaw/workspace/.env && bash scripts/cron-examples.sh setup-default
-
low Exfiltration
read-dotenvreferences/autonomous-trading.md:69Reads a .env filesource ~/.openclaw/workspace/.env && bash scripts/cron-examples.sh setup-autonomous
-
low Exfiltration
read-dotenvreferences/autonomous-trading.md:117Reads a .env filesource ~/.openclaw/workspace/.env && bash scripts/cron-examples.sh setup-default
-
low Secrets in code
secret-high-entropy-tokenreferences/autonomous-trading.md:197High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)"token_mint": "DezX…263",
quoted -
low Exfiltration
read-dotenvscripts/analysis.sh:13Reads a .env file (code comment)# Credentials must be pre-loaded in the environment (source ~/.openclaw/workspace/.env)
comment -
low Exfiltration
read-dotenvscripts/analysis.sh:15Reads a .env file (detector / deny-list definition)echo "ERROR: Run 'source ~/.openclaw/workspace/.env' before running this script."
detector -
low Exfiltration
read-dotenvscripts/cron_monitor.py:21Reads a .env file (code comment)# Credentials must be pre-loaded in the environment (source ~/.openclaw/workspace/.env)
comment -
low Exfiltration
read-dotenvscripts/cron_monitor.py:24Reads a .env file (detector / deny-list definition)print("ERROR: Missing KRYPTOGO_API_KEY or SOLANA_WALLET_ADDRESS. Run 'source ~/.openclaw/workspace/.env' first.")detector -
low Secrets in code
secret-high-entropy-tokenscripts/cron_monitor.py:34High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)SOL_MINT = "So11…112"
quoted -
low Exfiltration
read-dotenvscripts/cron_scan.py:23Reads a .env file (code comment; documentation of a security skill)# Credentials must be pre-loaded in the environment (source ~/.openclaw/workspace/.env)
commentsecurity skill -
low Secrets in code
secret-high-entropy-tokenscripts/cron_scan.py:44High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)SOL_MINT = "So11…112"
quoted -
low Exfiltration
read-dotenvscripts/cron-examples.sh:26Reads a .env file (detector / deny-list definition; test fixture / example file)--message "Run the monitoring script: 'source ~/.openclaw/workspace/.env && python3 skills/kryptogo-meme-trader/scripts/monitor.py'. Check portfolio for stop-loss or take-profit conditions. Report tri
detectorfixture -
low Exfiltration
read-dotenvscripts/cron-examples.sh:73Reads a .env file (detector / deny-list definition; test fixture / example file)--message "Run the monitoring script: 'source ~/.openclaw/workspace/.env && python3 skills/kryptogo-meme-trader/scripts/monitor.py'. Report the output."
detectorfixture -
low Exfiltration
read-dotenvscripts/monitor.py:8Reads a .env file (code comment)# Credentials must be pre-loaded in the environment (source ~/.openclaw/workspace/.env)
comment -
low Exfiltration
read-dotenvscripts/monitor.py:14Reads a .env file (detector / deny-list definition)print("Run 'source ~/.openclaw/workspace/.env' before running this script.")detector -
low Exfiltration
read-dotenvscripts/portfolio.sh:12Reads a .env file (code comment)# Credentials must be pre-loaded in the environment (source ~/.openclaw/workspace/.env)
comment -
low Exfiltration
read-dotenvscripts/portfolio.sh:14Reads a .env file (detector / deny-list definition)echo "ERROR: Run 'source ~/.openclaw/workspace/.env' before running this script."
detector -
low Risky intent
intent-wallet-secretsscripts/swap.py:26Handles crypto-wallet secrets (seed / mnemonic / private key) — a classic stealer target (quoted — discussed, not commanded)SOLANA_PRIVATE_KEY - Agent wallet private key (base58, never sent to server)
quoted -
low Exfiltration
read-dotenvscripts/swap.py:30Reads a .env file (detector / deny-list definition; security demo / example)the environment by the caller (e.g., `source ~/.openclaw/workspace/.env`).
detectordemo -
low Secrets in code
secret-high-entropy-tokenscripts/swap.py:59High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)SOL_MINT = "So11…112"
quoted -
low Exfiltration
read-dotenvscripts/swap.py:62Reads a .env file (detector / deny-list definition)sys.exit("ERROR: Missing required env vars. Run 'source ~/.openclaw/workspace/.env' before running this script.")detector -
low Exfiltration
read-dotenvscripts/test-api.sh:11Reads a .env file (code comment; test fixture / example file)# Credentials must be pre-loaded in the environment (source ~/.openclaw/workspace/.env)
commentfixture -
low Exfiltration
read-dotenvscripts/test-api.sh:13Reads a .env file (detector / deny-list definition; test fixture / example file)echo "ERROR: Run 'source ~/.openclaw/workspace/.env' before running this script."
detectorfixture -
low Exfiltration
read-dotenvscripts/trending.sh:13Reads a .env file (code comment)# Credentials must be pre-loaded in the environment (source ~/.openclaw/workspace/.env)
comment -
low Exfiltration
read-dotenvscripts/trending.sh:15Reads a .env file (detector / deny-list definition)echo "ERROR: Run 'source ~/.openclaw/workspace/.env' before running this script."
detector -
low Exfiltration
read-dotenvSKILL.md:111Reads a .env file (detector / deny-list definition)- Runtime scripts do NOT read `.env` directly — all credentials are accessed via environment variables only, which must be pre-loaded by the caller (`source ~/.openclaw/workspace/.env`)
detector -
low Exfiltration
read-dotenvSKILL.md:136Reads a .env filesource ~/.openclaw/workspace/.env
-
low Exfiltration
read-dotenvSKILL.md:188Reads a .env file (detector / deny-list definition)Runtime scripts in this skill do NOT read `.env` files directly. All credentials are accessed via environment variables only, which must be pre-loaded by the caller (`source ~/.openclaw/workspace/.env
detector -
low Exfiltration
read-dotenvSKILL.md:200Reads a .env filesource ~/.openclaw/workspace/.env && bash scripts/cron-examples.sh setup-default
-
low Exfiltration
read-dotenvSKILL.md:203Reads a .env filesource ~/.openclaw/workspace/.env && bash scripts/cron-examples.sh setup-autonomous
A further 1 matches are quotations in this security skill's documentation and are not counted as findings.
Files scanned: 19. Evidence is masked. Grey chips explain why severity was lowered.
Against the Agent Skills spec
- note
frontmatter-keyunknown frontmatter key "homepage" - note
frontmatter-keyunknown frontmatter key "docs" - note
frontmatter-keyunknown frontmatter key "platform" - note
frontmatter-keyunknown frontmatter key "api_base"
Process rating: all ten parameters 53/100
- 0Result and completion. Does not say what the result is
- 0Inputs and preconditions. Does not say what the process needs to start
- 20When it triggers. No condition that starts the skill
- 50Failures and branches. 0 branches, has a failure section
- 60Tools and files. Uses tools (web) that frontmatter does not declare
- 100Steps. 33 steps
- 100Consistency. Name and required fields are in place
- 100Execution cost. Instruction body is 3381 tokens
- 100Running it twice. Mutating operations check current state
- 100Progress reporting. Reports progress
- medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
- low 17 top-level sections: this looks like several domains in one skill
- low The response is described with custom markup (6 tags): a typed call is more reliable
Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.
Quality signals
- +5Description has no quoted example phrases that should trigger the skill
- +4Description does not say when NOT to use the skill (false activations)
- +3Output format is not stated: the model decides each time
- -33 of 10 scripts are never mentioned in SKILL.md
- +2Single-language instructions
- +3Description length 216: enough signal without eating the budget
- +4Structure: 36 headings
- +3Step-by-step instructions: 33 items
- +4Has examples (7 code blocks)
- +4Reference files are cited in the instructions (4 of 4)
- +1License stated
Quality base 70; lint remarks subtract, signals add up to 100. Result: 83.