Skills/ClawHub/krexa

krexa@1.5.2

VERIFIED

Publisher claims: "Use this skill when the user wants to research a trading idea, or turn an idea, post, reel or video into a tested strategy and deploy it as a live trading agent on Krexa. Covers Solana spot and tokenized stocks (xStocks), perps (Hyperliquid, Jupiter Perps, Polymarket Perps), Polymarket prediction markets, and perps in the user's own Binance, Bybit, OKX, Kraken or Coinbase account. Krexa runs the research, backtests and agents on its own servers and enforces trading limits in code. The key can ask for a deploy but cannot move money; the user approves every live deploy in the Krexa app." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher krexa · joined 14 days agoInstalls 366Last detonated 24 h ago
$clawhub install krexa
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-03 and scored it 86/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
Access to sensitive file pathsSKILL.md:126 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

No other findings across 500 lines in 5 files.