Latest release: v1.0.43Download zip
Capabilities
Compatibility
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The package purpose matches the artifacts: it teaches an agent to use the revx CLI for Revolut X market data, account queries, order placement, monitoring, Telegram alerts, and grid trading. Those are high-impact financial capabilities, but they are not hidden or unrelated.
Instruction Scope
Live order and grid-bot instructions include confirmation gates, but several credential flows ask users to provide API keys or Telegram bot tokens through the assistant/chat or command-line examples without clear secret-handling warnings.
Install Mechanism
The bundle contains markdown skill files and JSON manifests only, with no executable scripts, install hooks, bundled binaries, or package dependencies in the artifact itself. Static scan and VirusTotal telemetry were clean.
Credentials
Use of the revx CLI, Revolut X API credentials, local key material, Telegram API calls, and background monitoring is purpose-aligned, but the credential exposure patterns are under-scoped for a financial automation skill.
Persistence & Privilege
The skill discloses background monitors, grid-bot state persistence, and scoped Claude Bash allowlist changes. The allowlist instructions require user approval and avoid a blanket revx wildcard, but they still create persistent execution permission for recurring account commands.
Scan Findings in Context
[SDI-2] unexpected: The artifact does instruct adding specific Bash allowlist entries to .claude/settings.local.json for recurring account loops. It requires showing exact commands to the user and asking permission, so this is not hidden or malicious, but persistent command approval from an account-query skill is a Review concern.
[SQP-1] expected: The README trigger table is broad, but it accurately describes the bundled skills. This is partly expected for a skill bundle, though broad financial triggers increase the chance of unintended authenticated account access.
[SQP-2] expected: The README advertises live order placement and automated grid trading as core features. The detailed trading and strategy skills require explicit confirmation for live orders and warn that real money is involved, so the concern is mitigated but not eliminated.
[SQP-1] unexpected: The account skill uses phrases like checking balances and trades that could match generic user requests. Because this can access private financial account data, it would be better scoped to explicit Revolut X or revx intent.
[SQP-2] unexpected: The auth skill asks for an exchange API key and may set it via CLI without clear warnings about secret sensitivity, local storage, command history, or transcript exposure. That is material for a crypto trading integration.
[SQP-2] unexpected: The monitor workflow includes a Telegram token as a CLI argument. Telegram integration is expected, but placing tokens in visible commands is a weak secret-handling pattern.
[SQP-2] unexpected: The Telegram setup guide tells the user to share the bot token back in chat. That is not appropriate default handling for a long-lived bot credential.
[E1] expected: Contacting api.telegram.org is expected for Telegram setup, but embedding the bot token in a browser URL is an avoidable credential exposure risk rather than evidence of hidden exfiltration.
What to consider before installing
Install only if you intentionally want an assistant to help operate a real Revolut X crypto trading CLI. Use least-privilege API keys where possible, review every live trade or grid-bot launch before approving it, avoid pasting API keys or Telegram bot tokens into chat, and be cautious about adding persistent Bash allowlist entries or leaving background trading/monitoring processes running.Verification
Tags
Revolut X — OpenClaw / clawhub bundle
Revolut X is a low-fees crypto exchange by Revolut. Skills for crypto trading, market data, monitoring, and grid bot strategies on the Revolut X exchange.
Install
openclaw plugins install clawhub:revolut-x
Skills
| Skill | Trigger |
|---|---|
revx-auth | install, configure API keys, generate keypair, set passkey |
revx-market | check prices, view candles, ticker, order book, list pairs |
revx-account | balances, open orders, order history, fills, trade history |
revx-trading | place / cancel market and limit orders |
revx-monitor | live price + indicator alerts (RSI, EMA, MACD, Bollinger, OBI, ATR, …) |
revx-telegram | set up a Telegram connector for alerts |
revx-strategy | grid trading: backtest, optimize parameters, run a grid bot |
Prerequisites
The skills assume the revx CLI is installed and configured with your Revolut X API keys. See the main repository README for installation; the revx-auth skill walks the assistant through configuration if it isn't already set up.