📦 Crypto Signals Automation — 技能工具
v1.0.0Build and operate a crypto signal trading automation using RapidAPI cryptexAI Buy & Sell Signals as signal source and dYdX v4 for execution. Use when setting...
0· 273·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
high confidenceThe skill claims to provide a full RapidAPI -> dYdX trading pipeline but the package only contains a RapidAPI fetch script and an env-template writer while metadata declares no required credentials — sensitive keys/mnemonic handling is required by the instructions but not reflected in the manifest, which is incoherent and risky.
评估建议
This package is internally inconsistent: the README and templates expect RapidAPI and dYdX credentials (including a mnemonic) but the manifest claims no required env vars and the code does not implement dYdX/trading execution. Before installing or providing secrets: (1) do not paste real mnemonics or API secrets into chat; (2) review all code that will run the trading/execution logic — it is not included here; (3) require the author to provide or sign the dYdX execution code and update the manif...详细分析 ▾
⚠ 用途与能力
The description and SKILL.md promise a complete pipeline (signal ingestion, dYdX v4 order execution, TP/SL, retries, Telegram notifications). The included code, however, only implements RapidAPI fetch and writes an .env template; there is no dYdX client, no execution logic, and no Telegram notifier. Additionally, the registry metadata declares no required env vars or primary credential despite the skill explicitly requiring RapidAPI keys and dYdX secrets — this mismatch indicates the package is incomplete or misleading.
⚠ 指令范围
Runtime instructions ask the agent/operator to collect and handle highly sensitive secrets (RapidAPI key, dYdX wallet/mnemonic/API secrets, Telegram bot token) and to 'wire runtime script/cron' that will autonomously open/close orders. The instructions are open-ended about implementation details and grant broad discretion (e.g., scheduling, retries, cleanup) but the shipped code does not implement these behaviors. This gap increases the risk that users will paste secrets into chat or install/adapt third-party code of unknown provenance.
✓ 安装机制
There is no install spec (instruction-only + two small helper scripts). No external downloads or installers are used. The only file-writing behavior is the bootstrap script which creates a local .env template; that itself is low-risk but should be noted since it touches the filesystem.
⚠ 凭证需求
The skill requires multiple high-privilege secrets (RAPIDAPI_KEY, DYDX_API_KEY/SECRET/PASSPHRASE, DYDX mnemonic path, Telegram bot token) according to SKILL.md and bootstrap template, but the skill manifest lists none. Requesting wallet mnemonic and exchange API credentials is reasonable for trading automation, but the lack of declared required env vars and the package's incomplete implementation means users may be asked to provide sensitive credentials without clear, auditable code that will use them — disproportionate and potentially hazardous.
✓ 持久化与权限
The skill is not always-enabled and does not request system-wide persistence or modify other skills. It writes a local .env template if run, which is expected and scoped to the project directory.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/10
Crypto Signals Automation v1.0.0 - Initial release of a full pipeline to automate crypto trading signals using RapidAPI cryptexAI signals and dYdX v4 execution. - Supports setup of API keys, dYdX credentials, risk management, and alert channels. - Automates signal fetching, filtering, order execution with TP/SL, retries, cleanup, and Telegram notifications. - Includes scripts for connectivity validation and environment setup. - Provides detailed security guidance and references for setup and API use.
● 无害
安装命令
点击复制官方npx clawhub@latest install crypto-signals-automation
镜像加速npx clawhub@latest install crypto-signals-automation --registry https://cn.longxiaskill.com
技能文档
Use this skill to create a full pipeline: RapidAPI signals -> normalized signal objects -> dYdX v4 order execution.
Workflow
- Collect setup inputs first:
X-RapidAPI-Key)
- dYdX wallet address + mnemonic file path + subaccount
- risk settings (max leverage, margin per trade, max open positions, close-after-hours)
- TP/SL mode (reduce-only conditional orders)
- alert channels (Telegram chat IDs)
- Validate RapidAPI connectivity with
scripts/rapidapi_fetch.py. - Generate env template with
scripts/bootstrap_env.py. - Wire runtime script/cron that:
- Test with one symbol in controlled mode before enabling full symbol set.
RapidAPI source
- API:
cryptexAI - Buy & Sell Signals - Base host header:
cryptexai-buy-sell-signals.p.rapidapi.com - Endpoints:
GET /getSymbols
- GET /getSignalsForSymbol?symbol=...Use the most recent active=true signal per symbol. Deduplicate by signal id.
dYdX execution rules
- Use dYdX v4.
- Open position with market semantics.
- Set TP/SL immediately after open as reduce-only conditional orders:
- Retry failed order submissions up to total 3 attempts.
- Keep signal->order client_id mapping in state and only cancel matching reduce-only orders on cleanup.
Security
- Never commit real API keys/secrets.
- Store secrets in
.envwith strict file permissions (chmod 600). - Treat mnemonic/passphrase as secrets.
- If a token was exposed in chat/history, rotate it.
References
- API details:
references/rapidapi-cryptexai.md - Setup checklist:
references/setup-checklist.md