Web3-Crypto-Degen

AI Agent需配置 API Key

Universal Web3 & Crypto operating skill for AI agents. 12 domains, 60+ API endpoints, 5 providers: OKX DEX aggregator, Binance Web3 intelligence, Binance/Gat...

任务自动化工具调用

405

下载量

安装量

收藏量

★ 5.0

综合评分ⓘ

概述

更多信息

Web3 Crypto Ops v3.0.0#

Trigger Phrases#

I. Authentication#

⚠️ SECURITY: All credentials below are 🔴 Secret-level. They MUST be loaded from environment variables via process.env.*, NEVER hardcoded in source, logged, or transmitted in chat. See §XVI for the complete credential registry and agent rules.

OKX (HMAC-SHA256)#

text

Headers: OK-ACCESS-KEY, OK-ACCESS-SIGN, OK-ACCESS-PASSPHRASE, OK-ACCESS-TIMESTAMP
SIGN = Base64(HMAC-SHA256(timestamp+method+requestPath+body, SECRET))
GET: body="", requestPath includes queryString
POST: body=JSON, requestPath is path only
Env: OKX_API_KEY, OKX_SECRET_KEY, OKX_PASSPHRASE

Binance Spot (HMAC-SHA256)#

text

Header: X-MBX-APIKEY
Query: timestamp(ms) + signature=HMAC-SHA256(queryString, secret)
Mainnet: api.binance.com | Testnet: testnet.binance.vision
Env: BINANCE_API_KEY, BINANCE_SECRET_KEY

Gate.io v4 (HMAC-SHA512)#

text

Headers: KEY, Timestamp(seconds), SIGN
SIGN = HMAC-SHA512(secret, METHOD\n/api/v4/path\nqueryString\nSHA512(body)\ntimestamp)
Base: api.gateio.ws/api/v4
Env: GATE_API_KEY, GATE_SECRET_KEY
Rate limit: 900 req/s (private spot)
Note: Spot and Futures use SEPARATE API key pairs

Bitget v2 (HMAC-SHA256)#

text

Headers: ACCESS-KEY, ACCESS-SIGN, ACCESS-TIMESTAMP(ms), ACCESS-PASSPHRASE
SIGN = Base64(HMAC-SHA256(timestamp+METHOD+path+body, SECRET))
With queryString: timestamp+METHOD+path+?+queryString+body
Base: api.bitget.com
Env: BITGET_API_KEY, BITGET_SECRET_KEY, BITGET_PASSPHRASE
Note: Timestamp drift must be within ±10 seconds

Binance Web3 (No Auth)#

text

Public endpoints. Required header: Accept-Encoding: identity
POST also needs: Content-Type: application/json
Base: web3.binance.com
Warning: /bapi/defi/* are undocumented APIs — may change without notice, implement fallback

II. Chain ID Mapping#

ChainOKXBinanceK-Line PlatformNative Token AddressEthereum11eth0xeeee...eeeeBSC5656bsc0xeeee...eeeeSolana501CT_501solana11111111111111111111111111111111Base84538453base0xeeee...eeeeArbitrum42161——0xeeee...eeeePolygon137——0xeeee...eeee

CRITICAL: Solana native SOL uses 11111111111111111111111111111111. Do NOT use wSOL ( So111...112) — causes custom program error: 0xb. Exception: candles and trades endpoints require the wSOL address. Binance Solana chainId is CT_501, not 501.

Wrapped Native: BSC 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c | ETH 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2 | Base 0x4200000000000000000000000000000000000006

III. Domain 1 — Token Discovery#

APIMethodPathPurposeOKX SearchGET/api/v6/dex/market/token/search?chains=&search=Search by name/symbol/addressOKX RankingGET/api/v6/dex/market/token/toplist?chains=&sortBy={2|5|6}&timeFrame={1-4}Rank by change/volume/mcapOKX Basic InfoPOST/api/v6/dex/market/token/basic-infoBatch metadataOKX HoldersGET/api/v6/dex/market/token/holder?chainIndex=&tokenContractAddress=Top 20 holder distributionBinance SearchGETbapi/.../market/token/search?keyword=&chainIds=&orderBy=volume24hAlternative search sourceBinance Unified RankPOSTbapi/.../pulse/unified/rank/listTrending/Alpha/Stock ranking with filters

Unified Rank rankType: 10=Trending 11=Top Search 20=Alpha 40=Stock period: 10=1m 20=5m 30=1h 40=4h 50=24h sortBy: 40=marketCap 50=priceChange 70=volume 100=uniqueTraders

IV. Domain 2 — Market Data#

APIMethodPathReturnsOKX Price InfoPOST/api/v6/dex/market/price-infoprice, marketCap, liquidity, volume24H, priceChangeOKX Realtime PricePOST/api/v6/dex/market/priceprice (USD)OKX CandlesGET/api/v6/dex/market/candles?bar={interval}&limit=[ts,o,h,l,c,vol,volUsd,confirm]OKX HistoricalGET/api/v6/dex/market/historical-candlesSame format, older dataOKX TradesGET/api/v6/dex/market/tradestype, price, volume, dexNameOKX IndexPOST/GET/api/v6/dex/index/current-price | historical-priceMulti-source aggregated priceBinance DynamicGETbapi/.../token/dynamic/info?chainId=&contractAddress=price, fdv, kolHolders, smartMoneyHoldersBinance MetadataGETbapi/.../token/meta/info?chainId=&contractAddress=creatorAddress, links, auditInfoBinance K-LineGETdquery.sintral.io/u-kline/v1/k-line/candles?platform=&address=&interval=[o,h,l,c,vol,ts,count]

Intervals: 1s, 1m, 3m, 5m, 15m, 30m, 1H, 2H, 4H, 6H, 12H, 1D, 1W, 1M, 3M

V. Domain 3 — Security Audit & Safety Scoring#

Binance Token Audit#

POST bapi/.../security/token/audit Body: { "binanceChainId": "56|8453|CT_501|1", "contractAddress": "...", "requestId": "uuid" } Results valid ONLY when hasResult=true AND isSupported=true riskLevel: 0-1=LOW 2-3=MEDIUM 4=HIGH 5= BLOCK TRADE

Production 10-Point Safety Scoring#

#CheckSafe Threshold1LP Lock Rate≥80%2Top10 Holder Concentration≤45%3Liquidity (USD)≥$15,0004Market Cap (USD)≥$20,0005Holder Count≥1506Insider Holding %≤10%7Sniper Holding %≤8%824h Transaction Count≥809Dev Rug-Pull History= 010Dev Coins Launched≤5

Score = passedCount / totalChecks × 100. Pass requires: all checks passed AND totalChecks ≥ 3.

Honeypot Detection (Round-Trip Simulation)#

Simulate BUY: WNATIVE → Token (record amountOut)
Simulate SELL: Token → WNATIVE (use amountOut as input)
Recovery ratio = sellOut / originalAmount × 100
<50% = honeypot (85% confidence) | =0 = honeypot (90%) | 50-80% = suspicious | >80% = normal

Contract Risk Flags#

isHoneypot → BLOCK | hasMintMethod → HIGH risk | isLpNotLocked → Rug risk | hasNotRenounced → MEDIUM | isInBlacklist → MEDIUM

VI. Domain 4 — Wallet & Portfolio#

APIMethodPathOKX Total ValueGET/api/v6/dex/balance/total-value-by-address?address=&chains=OKX All BalancesGET/api/v6/dex/balance/all-token-balances-by-address?address=&chains=OKX Token BalancePOST/api/v6/dex/balance/token-balances-by-addressBinance PositionsGETbapi/.../address/pnl/active-position-list?address=&chainId=&offset=0

Note: OKX excludeRiskToken is Boolean for total-value but String("0"/"1") for token-balances. Native token: tokenContractAddress = "" (empty string).

VII. Domain 5 — DEX Swap Execution#

OKX Aggregator (all GET)#

EndpointPurpose/api/v6/dex/aggregator/quote?chainIndex=&fromTokenAddress=&toTokenAddress=&amount=Get quote/api/v6/dex/aggregator/approve-transaction?chainIndex=&tokenContractAddress=&approveAmount=ERC20 approval/api/v6/dex/aggregator/swap?chainIndex=&...&slippagePercent=1&userWalletAddress=Swap calldata/api/v6/dex/aggregator/swap-instruction?chainIndex=501&...Solana deserialized instructions

Amount must be in minimal units (wei/lamports). Default slippage: 1%.

Smart Router (V2/V3 Auto-Selection)#

Query all routes in parallel → pick highest amountOut:

V2 Router getAmountsOut(amountIn, [tokenIn, tokenOut])
V3 Quoter quoteExactInputSingle across ALL fee tiers (100, 500, 3000, 10000)
Sort by amountOut descending → select best

V2 Routers: BSC 0x10ED43C718714eb63d5aA57B78B54704E256024E | ETH 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D | Base 0x4752ba5DBc23f44D87826276BF6Fd6b1C372aD24 V3 Routers: ETH 0xE592427A0AEce92De3Edee1F18E0157C05861564 | Base 0x2626664c2603336E57B271c5C0b26F421741e481 | BSC 0x13f4EA83D0bd40E75C8222255bc855a974568Dd4 V3 Fees: 100 (0.01% stables), 500 (0.05%), 3000 (0.3% most pairs), 10000 (1% exotic)

Turbo Direct Pool (~15k-30k gas savings)#

Bypass router, call pool contracts directly:

V2: transfer token to pair → pair.swap(amount0Out, amount1Out, to, 0x)
V3: fallback to SwapRouter exactInputSingle (EOA can't call pool.swap callback)
V2 formula: amountOut = amountIn×997×reserveOut / (reserveIn×1000 + amountIn×997)

Solana Auto-Dispatch#

isPumpToken? → Pump.fun direct buy/sell : Jupiter aggregator

Safety Patterns#

Approve ONLY required amount — never maxUint256
Quote failure → BLOCK trade (prevents sandwich attacks)
Slippage: amountOutMin = expectedOut × (10000 - slippageBps) / 10000

VIII. Domain 6 — Broadcast & Tracking#

EndpointMethodPurpose/api/v6/dex/pre-transaction/gas-price?chainIndex=GETGas price/api/v6/dex/pre-transaction/gas-limitPOSTGas limit estimate/api/v6/dex/pre-transaction/simulatePOSTTx simulation/api/v6/dex/pre-transaction/broadcast-transactionPOSTBroadcast signed tx/api/v6/dex/post-transaction/orders?address=&chainIndex=GETOrder status tracking

Broadcast body: { "signedTx": "0x...", "chainIndex": "1", "address": "0x..." } MEV protection: extraData: { "enableMevProtection": true } (ETH/BSC/SOL/BASE) txStatus: 1=Pending 2=Success 3=Failed

IX. Domain 7 — Binance Spot#

EndpointMethodPurpose/api/v3/orderPOSTPlace order/api/v3/orderGETQuery order/api/v3/orderDELETECancel order/api/v3/order/testPOSTTest order (no exec)/api/v3/openOrdersGETOpen orders/api/v3/accountGETAccount info/api/v3/myTradesGETTrade history/api/v3/ticker/priceGETTicker/api/v3/klinesGETK-line/api/v3/depthGETOrder book

Order types: MARKET, LIMIT, STOP_LOSS, STOP_LOSS_LIMIT, TAKE_PROFIT, TAKE_PROFIT_LIMIT, LIMIT_MAKER Advanced: OCO, OTO, OTOCO conditional orders

X. Domain 8 — Gate.io Spot#

Auth: HMAC-SHA512 (see Section I)

EndpointMethodAuthPurpose/spot/ordersPOSTYesCreate order/spot/ordersGETYesList orders (params: status, market, limit)/spot/orders/{order_id}GETYesGet single order/spot/orders/{order_id}DELETEYesCancel single order/spot/ordersDELETEYesCancel all orders/spot/accountsGETYesSpot balance/spot/tickersGETNoTickers/spot/order_bookGETNoOrder book/spot/candlesticksGETNoK-line/spot/currency_pairsGETNoTrading pair rules/wallet/total_balanceGETYesTotal balance across all accounts

Order params: currency_pair ("BTC_USDT" underscore format), side (buy/sell), type (limit/market), amount, price, time_in_force (gtc/ioc/poc/fok), account ("spot")

Rate limit headers: X-Gate-RateLimit-Requests-Remain, X-Gate-RateLimit-Limit

XI. Domain 9 — Bitget Spot#

Auth: HMAC-SHA256 (see Section I)

EndpointMethodAuthPurpose/api/v2/spot/trade/place-orderPOSTYesPlace order/api/v2/spot/trade/cancel-orderPOSTYesCancel order (NOTE: uses POST not DELETE)/api/v2/spot/trade/batch-ordersPOSTYesBatch place (max 50)/api/v2/spot/trade/batch-cancel-orderPOSTYesBatch cancel/api/v2/spot/trade/orderInfoGETYesQuery single order/api/v2/spot/trade/unfilled-ordersGETYesOpen orders/api/v2/spot/trade/history-ordersGETYesOrder history/api/v2/spot/trade/fillsGETYesTrade fills/api/v2/spot/account/assetsGETYesSpot assets/api/v2/spot/account/infoGETYesAccount info/api/v2/spot/market/tickersGETNoTickers/api/v2/spot/market/orderbookGETNoOrder book/api/v2/spot/market/candlesGETNoK-line/api/v2/spot/market/fillsGETNoRecent trades/api/v2/account/all-account-balanceGETYesAll account balances

Order params: symbol ("BTCUSDT" no separator), side (buy/sell), orderType (limit/market), force (gtc/ioc/fok/post_only), price, size, clientOid (idempotency key)

XII. Domain 10 — Smart Money Signals#

Smart Money Trading Signals#

POST bapi/.../web/signal/smart-money Body: { "smartSignalType":"", "page":1, "pageSize":100, "chainId":"CT_501" } Chains: BSC (56), Solana (CT_501)

Key fields: direction (buy/sell), smartMoneyCount, alertPrice, currentPrice, maxGain (%), exitRate (%), status (active/timeout/completed)

Quality: Higher smartMoneyCount = more reliable. Low exitRate on active = smart money still holding.

Smart Money Inflow Rank#

POST bapi/.../tracker/wallet/token/inflow/rank/query Body: { "chainId":"56", "period":"24h", "tagType":2 }

GET bapi/.../pulse/social/hype/rank/leaderboard?chainId=&sentiment=All&targetLanguage=en&timeRange=1 Returns AI-generated multilingual sentiment summaries.

XIII. Domain 11 — Meme Rush#

Meme Rush Rank#

POST bapi/.../pulse/rank/list Body: { "chainId":"CT_501", "rankType":10, "limit":40 } rankType: 10=New (bonding curve) 20=Finalizing 30=Migrated to DEX

Protocols: Pump.fun (1001), Four.meme (2001), Moonshot (1010), Raydium (1005-1007), BONK (1008), Flap (2002)

Advanced filters: progress (curve %), holdersDevPercent, holdersSniperPercent, devSellPercent, tagDevWashTrading, excludeDevWashTrading

Meme Exclusive Rank#

GET bapi/.../pulse/exclusive/rank/list?chainId=56 Algorithm-scored Top 100 breakout potential memes.

Topic Rush#

GET bapi/.../social-rush/rank/list?chainId=&rankType={10|20|30}&sort={10|20|30} rankType: 10=Latest 20=Rising (ATH $1k-$20k) 30=Viral (ATH >$20k)

XIV. Domain 12 — PnL Leaderboard#

GET bapi/.../market/leaderboard/query?chainId=&period={7d|30d|90d}&tag={ALL|KOL}&pageNo=1&pageSize=25 Filters: PNLMin/Max, winRateMin/Max, txMin/Max, volumeMin/Max Returns: address, realizedPnl, winRate, totalVolume, topEarningTokens[], dailyPNL[]

RPC Health-Aware Failover#

Per-chain node health map: { url, healthy, latencyMs, failCount }

Select: healthy nodes → sort by latency → return lowest
All unhealthy: return node with fewest failures (graceful degradation)
On success: reset failCount, update latencyMs
On failure: failCount++; ≥3 consecutive → mark unhealthy
Background probe every 30s: eth_blockNumber to all nodes, 5s timeout

Risk Gates#

ConditionActionriskLevel=5 OR isHoneypot OR recovery<50%BLOCK TRADEtax>10% OR quote failure OR priceImpact>30%BLOCK TRADEriskLevel=4Strongly discourage, require override5%<tax≤10% OR impact>5%Warn + confirmliquidity<$1kStrongly discourage$1k≤liquidity<$10kWarn slippageSafety score<60 OR checks<3Warn, show failed itemsdevWashTrading=1 OR devPercent>20% OR sniper>30%Warn manipulationStill on bonding curveWarn high riskMainnet fund movementRequire user CONFIRM

Workflows#

A: Discover → Verify → Execute: Search → market data → 10-point safety scoring → honeypot sim → balance check → smart route quote → user CONFIRM → exact-amount approve → execute → track B: Portfolio Analysis: Balance query → enrich holdings → flag risk → suggest actions C: Signal-Driven: Smart money signals → inflow rank → safety filter → watchlist → execute via A D: CEX Spot: Select exchange (Binance/Gate/Bitget) → validate params → mainnet CONFIRM → place order → status. Cross-CEX price comparison E: Meme Sniping: Monitor rankType=10 → filter wash/social → 70-90% curve → smart money cross-ref → safety score → execute via A F: Copy-Trading: PnL leaderboard → filter winRate>60% → query positions → cross-ref signals → research → report G: Topic Narrative: Viral topics → AI summaries → lead tokens → quality verify → execute via A

Error Handling#

SourceCodeMeaningActionOKX50011Rate limitedExponential backoff + jitterOKX81104Chain unsupportedCheck /supported/chainOKX81451Node failedCheck gas/nonce/revertBinance Spot-1021Timestamp driftSync clockBinance Spot-2010Order rejectedCheck balance/permissionsGate.io401Auth failedVerify KEY + SIGNGate.io429Rate limitedCheck X-Gate-RateLimit headersBitget401Auth failedVerify KEY + SIGN + timestamp (±10s)Solana0xbWrong addressUse native SOL addressEVMnonce too lowAlready minedFetch latest nonce

Timeout: All APIs 10s timeout. On broadcast/order timeout → check status before retry (prevent double-spend).

Core Rules#

Security: Never output raw keys. Approve only required amounts. Mainnet ops require CONFIRM. Quote failure = block. See §XVI–§XVII for full credential handling rules. Units: APIs use minimal units (wei/lamports); display uses UI units. amount_min = amount_ui × 10^decimal. Formats: Gate.io uses underscore pairs "BTC_USDT"; Bitget uses no separator "BTCUSDT". Fallback: OKX search ↔ Binance search, OKX candles ↔ Sintral K-line, OKX balance ↔ Binance positions. CEX failure → suggest alternative exchange. RPC: Auto-failover via health manager. 30s probe, 5s timeout, 3 consecutive failures = unhealthy. Output: Concise decision summaries → risk flags first → blocked trades get reason + alternatives → disclaimer at end.

XVI. Credential & Environment Variable Registry#

This skill requires credentials for 5 providers. Below is the complete registry of all environment variables, their purpose, and security classification.

Required Environment Variables#

VariableProviderPurposeSensitivityOKX_API_KEYOKX DEXHMAC signing (key)🔴 SecretOKX_SECRET_KEYOKX DEXHMAC signing (secret)🔴 SecretOKX_PASSPHRASEOKX DEXAPI passphrase🔴 SecretBINANCE_API_KEYBinance SpotRequest header auth🔴 SecretBINANCE_SECRET_KEYBinance SpotHMAC signing🔴 SecretGATE_API_KEYGate.ioRequest header auth🔴 SecretGATE_SECRET_KEYGate.ioHMAC-SHA512 signing🔴 SecretBITGET_API_KEYBitgetRequest header auth🔴 SecretBITGET_SECRET_KEYBitgetHMAC signing🔴 SecretBITGET_PASSPHRASEBitgetAPI passphrase🔴 SecretRPC_ETHEthereum RPCChain interaction🟡 SensitiveRPC_BSCBSC RPCChain interaction🟡 SensitiveRPC_BASEBase RPCChain interaction🟡 SensitiveRPC_ARBArbitrum RPCChain interaction🟡 SensitiveRPC_SOLSolana RPCChain interaction🟡 SensitiveDEPLOYER_PRIVATE_KEYEVM tx signingOn-chain trade execution🔴 CriticalSOL_PRIVATE_KEYSolana tx signingOn-chain trade execution🔴 CriticalVAULT_TIMEOUT_MSVaultAuto-lock duration⚪ ConfigENABLE_TESTNETRoutingRoute through testnets⚪ Config

Sensitivity Levels#

text

⚪ Config:     Safe to commit to .env.example as placeholder values
🟡 Sensitive:  Must be in .env (gitignored), contains API keys or RPC endpoints with keys
🔴 Secret:     Must NEVER appear in logs, code, or git history
🔴 Critical:   Private keys — highest security; compromise = total fund loss

Agent Behavior: When to Request Credentials#

text

Rule 1: NEVER invent, generate, or hardcode real API keys or secrets.
        Use placeholder values in .env.example only.
Rule 2: When scaffolding, create .env.example with descriptive placeholders:
        OKX_API_KEY=your-okx-api-key
        OKX_SECRET_KEY=your-okx-secret-key
        DEPLOYER_PRIVATE_KEY=0x_DO_NOT_COMMIT_REAL_KEY
Rule 3: Add .env to .gitignore BEFORE any .env file is created.
Rule 4: When a feature needs a credential not yet configured:
        → Tell the user which variable is needed and which provider dashboard to get it from
        → Provide the provider's API key management URL:
          - OKX: https://www.okx.com/account/my-api
          - Binance: https://www.binance.com/en/my/settings/api-management
          - Gate.io: https://www.gate.io/myaccount/apikeys
          - Bitget: https://www.bitget.com/account/newapi
          - Alchemy (RPC): https://dashboard.alchemy.com
        → Ask the user to set it in .env
        → NEVER ask the user to paste secrets into chat
Rule 5: For DEPLOYER_PRIVATE_KEY / SOL_PRIVATE_KEY:
        → Recommend generating locally (cast wallet new, solana-keygen new)
        → For mainnet: use hardware wallet or the project Vault system
        → NEVER use a funded mainnet key in .env on a dev machine
Rule 6: When implementing auth signing functions:
        → Load secrets with process.env.* at module init
        → Validate presence at startup: if (!key) throw new Error('Missing OKX_API_KEY')
        → NEVER pass secrets as function parameters through the call stack
Rule 7: Agent Scope Limits (Infrastructure):
        → The agent runs purely as a trading helper. Infrastructure secrets
          (e.g., DATABASE_URL, REDIS_URL, JWT_SECRET) are EXPLICITLY OUT OF SCOPE.
        → NEVER attempt to read, request, or persist data directly using backend services.
        → All state must be passed through safe API layers, never via direct DB connections.

XVII. Security: Agent Rules for Sensitive Key Handling#

Mandatory rules for any AI agent following this skill when handling API keys, private keys, and credential material during development, testing, and deployment.

Agent MUST Rules (Non-Negotiable)#

text

1. NEVER echo, log, print, or return API keys/secrets to stdout, stderr, or chat.
   Masking rule: key.slice(0,4) + '****' + key.slice(-4)
2. NEVER include real secrets in code, comments, commit messages, or artifacts.
3. NEVER store secrets in source-controlled files.
   Only .env (which MUST be in .gitignore) may contain real credentials.
4. NEVER transmit secrets over unencrypted channels or embed in URLs.
5. When writing HMAC signing utilities:
   → Secret key MUST come from process.env exclusively
   → The signing function MUST NOT log the computed signature in production
   → Timestamp synchronization: use server time diff calibration
6. When writing trade execution code:
   → Private keys MUST be decrypted from Vault at execution time only
   → Zero-fill key Buffer after use: keyBuffer.fill(0)
   → NEVER cache decrypted private keys in global scope
7. When writing Docker/CI configs:
   → Use secrets managers (Docker secrets, GitHub Actions secrets)
   → NEVER bake API keys into Docker images or CI YAML
8. When implementing CEX API clients:
   → Use IP whitelisting where the exchange supports it (all 4 do)
   → Enable TRADE-ONLY permissions — WITHDRAWAL PERMISSION MUST BE DISABLED on all keys
   → Implement separate key pairs for spot vs futures (Gate.io requirement)
   → Verify no withdrawal permission is enabled before any integration test
9. Principle of Least Privilege enforcement:
   → OKX:     Read + Trade. Withdrawal = OFF. IP whitelist = REQUIRED.
   → Binance:  Read + Trade. Withdrawal = OFF. Margin = OFF unless explicitly needed.
   → Gate.io:  Spot trade only. Futures = SEPARATE key. Withdrawal = OFF.
   → Bitget:   Read + Trade. Withdrawal = OFF. IP whitelist recommended.
   → EVM key:  Dedicated wallet, minimal balance, never a primary wallet.
   → SOL key:  Dedicated wallet, minimal balance, never a primary wallet.
10. Testnet-first mandate:
    → Set ENABLE_TESTNET=true and test ALL workflows on testnets BEFORE mainnet.
    → Binance testnet: testnet.binance.vision
    → Only after successful testnet validation may the agent proceed to mainnet.

Exchange-Specific Security Notes#

ExchangeKey RotationIP WhitelistPermission GranularityNotesOKX90-day recommended✅ Required for tradeRead / Trade / WithdrawPassphrase adds extra layerBinanceNo expiry, manual✅ Strongly recommendedRead / Trade / Withdraw / MarginEnable HMAC-only (no Ed25519) for compatibilityGate.ioNo expiry, manual✅ AvailableSpot / Futures / Withdrawal (separate)Spot and Futures need SEPARATE key pairsBitgetNo expiry, manual✅ AvailableRead / Trade / WithdrawPassphrase required; ±10s timestamp tolerance

Credential Lifecycle#

text

┌──────────────────┐    ┌──────────────────┐    ┌──────────────────┐
│   GENERATION     │───▶│    STORAGE       │───▶│     USAGE        │
│                  │    │                  │    │                  │
│ Exchange UI      │    │ .env file (dev)  │    │ process.env.*    │
│ cast wallet new  │    │ Vault (prod)     │    │ Vault decrypt    │
│ solana-keygen    │    │ Docker secrets   │    │ HMAC sign()      │
└──────────────────┘    └──────────────────┘    └───────┬──────────┘
                               │                        │
                         ┌─────▼──────┐          ┌──────▼─────┐
                         │  ROTATION  │          │  CLEANUP   │
                         │ API: 90d   │          │ Zero-fill  │
                         │ JWT: 15m   │          │ Buffer     │
                         │ Refresh:7d │          │ after use  │
                         └────────────┘          └────────────┘

.env.example Template#

The agent MUST generate this file when scaffolding a project using this skill:

bash

# === OKX DEX Aggregator (https://www.okx.com/account/my-api) ===
OKX_API_KEY=your-okx-api-key
OKX_SECRET_KEY=your-okx-secret-key
OKX_PASSPHRASE=your-okx-passphrase

# === Binance Spot (https://www.binance.com/en/my/settings/api-management) ===
BINANCE_API_KEY=your-binance-api-key
BINANCE_SECRET_KEY=your-binance-secret-key

# === Gate.io Spot (https://www.gate.io/myaccount/apikeys) ===
# NOTE: Spot and Futures require SEPARATE key pairs
GATE_API_KEY=your-gate-spot-api-key
GATE_SECRET_KEY=your-gate-spot-secret-key

# === Bitget Spot (https://www.bitget.com/account/newapi) ===
BITGET_API_KEY=your-bitget-api-key
BITGET_SECRET_KEY=your-bitget-secret-key
BITGET_PASSPHRASE=your-bitget-passphrase

# === Blockchain RPC (https://dashboard.alchemy.com) ===
RPC_ETH=https://eth-mainnet.g.alchemy.com/v2/YOUR_KEY
RPC_BSC=https://bsc-dataseed1.binance.org
RPC_BASE=https://base-mainnet.g.alchemy.com/v2/YOUR_KEY
RPC_ARB=https://arb-mainnet.g.alchemy.com/v2/YOUR_KEY
RPC_SOL=https://api.mainnet-beta.solana.com

# === On-Chain Signing (NEVER commit funded mainnet keys) ===
# Generate a fresh dedicated wallet: cast wallet new (EVM) | solana-keygen new (Solana)
# Use a SMALL-BALANCE ONLY wallet. NEVER use a primary/funded mainnet wallet here.
DEPLOYER_PRIVATE_KEY=
# ↑ Leave blank. Populate ONLY with a freshly generated, isolated dev/test wallet key.
SOL_PRIVATE_KEY=
# ↑ Leave blank. Base58 key — generate with: solana-keygen new --no-bip39-passphrase

# === Infrastructure ===
# NOTE: Trade_Tool backend services manage their own standalone configuration.
# Infrastructure secrets (DB, Redis, JWT) are completely isolated from this agent skill.
VAULT_TIMEOUT_MS=28800000
ENABLE_TESTNET=true

XVIII. Pre-Install Security Checklist#

Before activating this skill with live credentials, verify every item below:

#CheckStatus1Testnet first — ENABLE_TESTNET=true tested successfully before mainnet☐2Dedicated wallets — DEPLOYER_PRIVATE_KEY / SOL_PRIVATE_KEY are fresh wallets with minimal balance, not your primary wallet☐3Withdrawal disabled — All CEX API keys (OKX / Binance / Gate / Bitget) have withdrawal permission explicitly OFF☐4IP whitelist enabled — All exchange API keys locked to your server's IP address☐5Trade-only scope — No Margin, Futures, or Cross-account permissions granted unless required☐6Secrets in .env only — Credentials stored in .env (gitignored), never in source code or chat☐7Vault for mainnet — Production keys stored in the project Vault system, not plain .env☐8Provenance verified — Skill source confirmed at https://github.com/StanPoldark/Trade_Tool☐9Metadata in sync — requiredEnv in YAML frontmatter matches §XVI table (verify: diff the name: fields in the YAML block against the §XVI Variable column, zero delta expected)☐10Small balance test — First mainnet trade uses smallest viable amount to validate integration☐

How to use: Copy this checklist into your project's SECURITY.md and confirm each item before going live. Skip any item only if that provider is not used in your deployment.

⚠️ This skill provides operational reference only and does not constitute investment advice. Always DYOR.

捕获经验教训、错误及修正内容，以实现持续改进。适用于以下场景：（1）命令或操作意外失败；（2）用户纠正Claude（如“不，那不对……”“实际上……”）；（3）用户请求的功能不存在；（4）外部API或工具出现故障；（5）Claude发现自身知识已过时或不正确；（6）针对重复性任务发现了更优方法。同时，在执行重大任务前应回顾已积累的经验教训。

AI Agent

★ 4116↓ 83.7万3 个月前更新

场景驱动+关键词双模式技能发现工具。当用户用自然语言描述场景/需求（如"我想做一个海报""帮我分析股票"），或明确说"安装技能/find skills/找个skill"时，自动从官方内置、本地已安装、SkillHub、虾评、GitHub、ClawHub 六层联合搜索并推荐最合适的技能，支持一键安装。已完全替代官方...

AI Agent

★ 1482↓ 54.5万3 个月前更新

自我反思+自我批评+自我学习+自组织记忆。智能体评估自身工作、发现错误并持续改进。

AI Agent

★ 1402↓ 32.4万3 个月前更新

Web3-Crypto-Degen

Web3 Crypto Ops v3.0.0#

Trigger Phrases#

I. Authentication#

OKX (HMAC-SHA256)#

Binance Spot (HMAC-SHA256)#

Gate.io v4 (HMAC-SHA512)#

Bitget v2 (HMAC-SHA256)#

Binance Web3 (No Auth)#

II. Chain ID Mapping#

III. Domain 1 — Token Discovery#

IV. Domain 2 — Market Data#

V. Domain 3 — Security Audit & Safety Scoring#

Binance Token Audit#

Production 10-Point Safety Scoring#

Honeypot Detection (Round-Trip Simulation)#

Contract Risk Flags#

VI. Domain 4 — Wallet & Portfolio#

VII. Domain 5 — DEX Swap Execution#

OKX Aggregator (all GET)#

Smart Router (V2/V3 Auto-Selection)#

Turbo Direct Pool (~15k-30k gas savings)#

Solana Auto-Dispatch#

Safety Patterns#

VIII. Domain 6 — Broadcast & Tracking#

IX. Domain 7 — Binance Spot#

X. Domain 8 — Gate.io Spot#

XI. Domain 9 — Bitget Spot#

XII. Domain 10 — Smart Money Signals#

Smart Money Trading Signals#

Smart Money Inflow Rank#

Social Hype Leaderboard#

XIII. Domain 11 — Meme Rush#

Meme Rush Rank#

Meme Exclusive Rank#

Topic Rush#

XIV. Domain 12 — PnL Leaderboard#

RPC Health-Aware Failover#

Risk Gates#

Workflows#

Error Handling#

Core Rules#

XVI. Credential & Environment Variable Registry#

Required Environment Variables#

Sensitivity Levels#

Agent Behavior: When to Request Credentials#

XVII. Security: Agent Rules for Sensitive Key Handling#

Agent MUST Rules (Non-Negotiable)#

Exchange-Specific Security Notes#

Credential Lifecycle#

.env.example Template#

XVIII. Pre-Install Security Checklist#

相关推荐

self-improving agent

Find Skills

Self-Improving + Proactive Agent

Agent Browser

Skill Vetter

ontology