Skill: stanpoldark/web3-crypto-ops-skill (version 1.0.4)

--- name: web3-crypto-ops description: > Universal Web3 & Crypto operating skill for AI agents. 12 domains, 60+ API endpoints, 5 providers: OKX DEX aggregator, Binance Web3 intelligence, Binance/Gate.io/Bitget Spot. Production-grade patterns: RPC health failover, 10-point token safety scoring, honeypot round-trip simulation, V2/V3 smart routing, direct pool turbo execution, Pump.fun/Jupiter auto-dispatch. Commercial risk gates and compliance controls built-in. license: Apache-2.0 # ── Invocation policy ─────────────────────────────────────────────────────── # always:false → skill is user-invocable only; NOT silently auto-triggered. # Platform must prompt the user before any mainnet fund movement. always: false metadata: version: "1.0.3" tags: [web3, crypto, dex, cex, swap, portfolio, audit, smart-money, meme, signals, gate, bitget] categories: [trading, defi, analytics, security, market-intelligence] compatibility: [openclaw, gemini-cli] providers: [okx-dex, binance-web3, binance-spot, gate-spot, bitget-spot] chains: [ethereum, bsc, solana, base, arbitrum, polygon, xlayer] # ── Required environment variables (surfaced to platform registry) ─────────── # CRITICAL: This block MUST match §XVI of the skill body exactly. # A mismatch between this list and §XVI is a security red flag — keep in sync. requiredEnv: # ── CEX API keys (trade-only, NO withdrawal permission) ── - OKX_API_KEY - OKX_SECRET_KEY - OKX_PASSPHRASE - BINANCE_API_KEY - BINANCE_SECRET_KEY - GATE_API_KEY - GATE_SECRET_KEY - BITGET_API_KEY - BITGET_SECRET_KEY - BITGET_PASSPHRASE # ── Blockchain RPC endpoints ── - RPC_ETH - RPC_BSC - RPC_BASE - RPC_ARB - RPC_SOL # ── On-chain signing keys (CRITICAL — highest privilege) ── - DEPLOYER_PRIVATE_KEY - SOL_PRIVATE_KEY # ── Feature flags & configs ── - VAULT_TIMEOUT_MS - ENABLE_TESTNET --- # Web3 Crypto Ops v3.0.0 ## Trigger Phrases Token search / trending / rankings | Price / K-line / charts | Security audit / honeypot scan | Wallet balance / holdings | DEX swap / on-chain trade | Gas estimate / broadcast / track | Binance / Gate / Bitget spot order | Smart money signals / social hype | Meme Rush / Pump.fun / Four.meme | PnL leaderboard / KOL tracking --- ## I. Authentication > **⚠️ SECURITY**: All credentials below are 🔴 Secret-level. They MUST be loaded from > environment variables via `process.env.*`, NEVER hardcoded in source, logged, or > transmitted in chat. See §XVI for the complete credential registry and agent rules. ### OKX (HMAC-SHA256) ``` Headers: OK-ACCESS-KEY, OK-ACCESS-SIGN, OK-ACCESS-PASSPHRASE, OK-ACCESS-TIMESTAMP SIGN = Base64(HMAC-SHA256(timestamp+method+requestPath+body, SECRET)) GET: body="", requestPath includes queryString POST: body=JSON, requestPath is path only Env: OKX_API_KEY, OKX_SECRET_KEY, OKX_PASSPHRASE ``` ### Binance Spot (HMAC-SHA256) ``` Header: X-MBX-APIKEY Query: timestamp(ms) + signature=HMAC-SHA256(queryString, secret) Mainnet: api.binance.com | Testnet: testnet.binance.vision Env: BINANCE_API_KEY, BINANCE_SECRET_KEY ``` ### Gate.io v4 (HMAC-SHA512) ``` Headers: KEY, Timestamp(seconds), SIGN SIGN = HMAC-SHA512(secret, METHOD\n/api/v4/path\nqueryString\nSHA512(body)\ntimestamp) Base: api.gateio.ws/api/v4 Env: GATE_API_KEY, GATE_SECRET_KEY Rate limit: 900 req/s (private spot) Note: Spot and Futures use SEPARATE API key pairs ``` ### Bitget v2 (HMAC-SHA256) ``` Headers: ACCESS-KEY, ACCESS-SIGN, ACCESS-TIMESTAMP(ms), ACCESS-PASSPHRASE SIGN = Base64(HMAC-SHA256(timestamp+METHOD+path+body, SECRET)) With queryString: timestamp+METHOD+path+?+queryString+body Base: api.bitget.com Env: BITGET_API_KEY, BITGET_SECRET_KEY, BITGET_PASSPHRASE Note: Timestamp drift must be within ±10 seconds ``` ### Binance Web3 (No Auth) ``` Public endpoints. Required header: Accept-Encoding: identity POST also needs: Content-Type: application/json Base: web3.binance.com Warning: /bapi/defi/* are undocumented APIs — may change without notice, implement fallback ``` --- ## II. Chain ID Mapping | Chain | OKX | Binance | K-Line Platform | Native Token Address | | -------- | ----- | ------- | --------------- | -------------------------------- | | Ethereum | 1 | 1 | eth | 0xeeee...eeee | | BSC | 56 | 56 | bsc | 0xeeee...eeee | | Solana | 501 | CT_501 | solana | 11111111111111111111111111111111 | | Base | 8453 | 8453 | base | 0xeeee...eeee | | Arbitrum | 42161 | — | — | 0xeeee...eeee | | Polygon | 137 | — | — | 0xeeee...eeee | **CRITICAL**: Solana native SOL uses [REDACTED_SECRET]. Do NOT use wSOL (`So111...112`) — causes `custom program error: 0xb`. Exception: candles and trades endpoints require the wSOL address. Binance Solana chainId is `CT_501`, not `501`. **Wrapped Native**: BSC [REDACTED_SECRET] | ETH [REDACTED_SECRET] | Base [REDACTED_SECRET] --- ## III. Domain 1 — Token Discovery | API | Method | Path | Purpose | | -------------------- | ------ | ------------------------------------------------------------------------- | ----------------------------------------- | | OKX Search | GET | /api/v6/dex/market/token/search?chains=&search= | Search by name/symbol/address | | OKX Ranking | GET | /api/v6/dex/market/token/toplist?chains=&sortBy={2\|5\|6}&timeFrame={1-4} | Rank by change/volume/mcap | | OKX Basic Info | POST | /api/v6/dex/market/token/basic-info | Batch metadata | | OKX Holders | GET | /api/v6/dex/market/token/holder?chainIndex=&tokenContractAddress= | Top 20 holder distribution | | Binance Search | GET | bapi/.../market/token/search?keyword=&chainIds=&orderBy=volume24h | Alternative search source | | Binance Unified Rank | POST | bapi/.../pulse/unified/rank/list | Trending/Alpha/Stock ranking with filters | Unified Rank rankType: 10=Trending 11=Top Search 20=Alpha 40=Stock period: 10=1m 20=5m 30=1h 40=4h 50=24h sortBy: 40=marketCap 50=priceChange 70=volume 100=uniqueTraders --- ## IV. Domain 2 — Market Data | API | Method | Path | Returns | | ------------------ | -------- | ------------------------------------------------------------------------ | --------------------------------------------------- | | OKX Price Info | POST | /api/v6/dex/market/price-info | price, marketCap, liquidity, volume24H, priceChange | | OKX Realtime Price | POST | /api/v6/dex/market/price | price (USD) | | OKX Candles | GET | /api/v6/dex/market/candles?bar={interval}&limit= | [ts,o,h,l,c,vol,volUsd,confirm] | | OKX Historical | GET | /api/v6/dex/market/historical-candles | Same format, older data | | OKX Trades | GET | /api/v6/dex/market/trades | type, price, volume, dexName | | OKX Index | POST/GET | /api/v6/dex/index/current-price \| historical-price | Multi-source aggregated price | | Binance Dynamic | GET | bapi/.../token/dynamic/info?chainId=&contractAddress= | price, fdv, kolHolders, smartMoneyHolders | | Binance Metadata | GET | bapi/.../token/meta/info?chainId=&contractAddress= | creatorAddress, links, auditInfo | | Binance K-Line | GET | dquery.sintral.io/u-kline/v1/k-line/candles?platform=&address=&interval= | [o,h,l,c,vol,ts,count] | Intervals: 1s, 1m, 3m, 5m, 15m, 30m, 1H, 2H, 4H, 6H, 12H, 1D, 1W, 1M, 3M --- ## V. Domain 3 — Security Audit & Safety Scoring ### Binance Token Audit POST `bapi/.../security/token/audit` Body: `{ "binanceChainId": "56|8453|CT_501|1", "contractAddress": "...", "requestId": "uuid" }` **Results valid ONLY when hasResult=true AND isSupported=true** riskLevel: 0-1=LOW 2-3=MEDIUM 4=HIGH 5=**BLOCK TRADE** ### Production 10-Point Safety Scoring | # | Check | Safe Threshold | | --- | -------------------------- | -------------- | | 1 | LP Lock Rate | ≥80% | | 2 | Top10 Holder Concentration | ≤45% | | 3 | Liquidity (USD) | ≥$15,000 | | 4 | Market Cap (USD) | ≥$20,000 | | 5 | Holder Count | ≥150 | | 6 | Insider Holding % | ≤10% | | 7 | Sniper Holding % | ≤8% | | 8 | 24h Transaction Count | ≥80 | | 9 | Dev Rug-Pull History | = 0 | | 10 | Dev Coins Launched | ≤5 | Score = passedCount / totalChecks × 100. Pass requires: all checks passed AND totalChecks ≥ 3. ### Honeypot Detection (Round-Trip Simulation) 1. Simulate BUY: WNATIVE → Token (record amountOut) 2. Simulate SELL: Token → WNATIVE (use amountOut as input) 3. Recovery ratio = sellOut / originalAmount × 100 4. <50% = honeypot (85% confidence) | =0 = honeypot (90%) | 50-80% = suspicious | >80% = normal ### Contract Risk Flags isHoneypot → **BLOCK** | hasMintMethod → HIGH risk | isLpNotLocked → Rug risk | hasNotRenounced → MEDIUM | isInBlacklist → MEDIUM --- ## VI. Domain 4 — Wallet & Portfolio | API | Method | Path | | ----------------- | ------ | -------------------------------------------------------------------- | | OKX Total Value | GET | /api/v6/dex/balance/total-value-by-address?address=&chains= | | OKX All Balances | GET | /api/v6/dex/balance/all-token-balances-by-address?address=&chains= | | OKX Token Balance | POST | /api/v6/dex/balance/token-balances-by-address | | Binance Positions | GET | bapi/.../address/pnl/active-position-list?address=&chainId=&offset=0 | Note: OKX excludeRiskToken is Boolean for total-value but String("0"/"1") for token-balances. Native [REDACTED_SECRET] = "" (empty string). --- ## VII. Domain 5 — DEX Swap Execution ### OKX Aggregator (all GET) | Endpoint | Purpose | | ------------------------------------------------------------------------------------------- | -------------------------------- | | /api/v6/dex/aggregator/quote?chainIndex=&fromTokenAddress=&toTokenAddress=&amount= | Get quote | | /api/v6/dex/aggregator/approve-transaction?chainIndex=&tokenContractAddress=&approveAmount= | ERC20 approval | | /api/v6/dex/aggregator/swap?chainIndex=&...&slippagePercent=1&userWalletAddress= | Swap calldata | | /api/v6/dex/aggregator/swap-instruction?chainIndex=501&... | Solana deserialized instructions | Amount must be in minimal units (wei/lamports). Default slippage: 1%. ### Smart Router (V2/V3 Auto-Selection) Query all routes in parallel → pick highest amountOut: 1. V2 Router `getAmountsOut(amountIn, [tokenIn, tokenOut])` 2. V3 Quoter `quoteExactInputSingle` across ALL fee tiers (100, 500, 3000, 10000) 3. Sort by amountOut descending → select best **V2 Routers**: BSC [REDACTED_SECRET] | ETH [REDACTED_SECRET] | Base [REDACTED_SECRET] **V3 Routers**: ETH [REDACTED_SECRET] | Base [REDACTED_SECRET] | BSC [REDACTED_SECRET] **V3 Fees**: 100 (0.01% stables), 500 (0.05%), 3000 (0.3% most pairs), 10000 (1% exotic) ### Turbo Direct Pool (~15k-30k gas savings) Bypass router, call pool contracts directly: - V2: transfer token to pair → pair.swap(amount0Out, amount1Out, to, 0x) - V3: fallback to SwapRouter exactInputSingle (EOA can't call pool.swap callback) - V2 formula: `amountOut = amountIn×997×reserveOut / (reserveIn×1000 + amountIn×997)` ### Solana Auto-Dispatch isPumpToken? → Pump.fun direct buy/sell : Jupiter aggregator ### Safety Patterns - Approve ONLY required amount — **never maxUint256** - Quote failure → **BLOCK trade** (prevents sandwich attacks) - Slippage: `amountOutMin = expectedOut × (10000 - slippageBps) / 10000` --- ## VIII. Domain 6 — Broadcast & Tracking | Endpoint | Method | Purpose | | -------------------------------------------------------- | ------ | --------------------- | | /api/v6/dex/pre-transaction/gas-price?chainIndex= | GET | Gas price | | /api/v6/dex/pre-transaction/gas-limit | POST | Gas limit estimate | | /api/v6/dex/pre-transaction/simulate | POST | Tx simulation | | /api/v6/dex/pre-transaction/broadcast-transaction | POST | Broadcast signed tx | | /api/v6/dex/post-transaction/orders?address=&chainIndex= | GET | Order status tracking | Broadcast body: `{ "signedTx": "0x...", "chainIndex": "1", "address": "0x..." }` MEV protection: `extraData: { "enableMevProtection": true }` (ETH/BSC/SOL/BASE) txStatus: 1=Pending 2=Success 3=Failed --- ## IX. Domain 7 — Binance Spot | Endpoint | Method | Purpose | | -------------------- | ------ | -------------------- | | /api/v3/order | POST | Place order | | /api/v3/order | GET | Query order | | /api/v3/order | DELETE | Cancel order | | /api/v3/order/test | POST | Test order (no exec) | | /api/v3/openOrders | GET | Open orders | | /api/v3/account | GET | Account info | | /api/v3/myTrades | GET | Trade history | | /api/v3/ticker/price | GET | Ticker | | /api/v3/klines | GET | K-line | | /api/v3/depth | GET | Order book | Order types: MARKET, LIMIT, STOP_LOSS, STOP_LOSS_LIMIT, TAKE_PROFIT, TAKE_PROFIT_LIMIT, LIMIT_MAKER Advanced: OCO, OTO, OTOCO conditional orders --- ## X. Domain 8 — Gate.io Spot Auth: HMAC-SHA512 (see Section I) | Endpoint | Method | Auth | Purpose | | ----------------------- | ------ | ---- | ------------------------------------------- | | /spot/orders | POST | Yes | Create order | | /spot/orders | GET | Yes | List orders (params: status, market, limit) | | /spot/orders/{order_id} | GET | Yes | Get single order | | /spot/orders/{order_id} | DELETE | Yes | Cancel single order | | /spot/orders | DELETE | Yes | Cancel all orders | | /spot/accounts | GET | Yes | Spot balance | | /spot/tickers | GET | No | Tickers | | /spot/order_book | GET | No | Order book | | /spot/candlesticks | GET | No | K-line | | /spot/currency_pairs | GET | No | Trading pair rules | | /wallet/total_balance | GET | Yes | Total balance across all accounts | **Order params**: currency_pair ("BTC_USDT" underscore format), side (buy/sell), type (limit/market), amount, price, time_in_force (gtc/ioc/poc/fok), account ("spot") Rate limit headers: [REDACTED_SECRET], `X-Gate-RateLimit-Limit` --- ## XI. Domain 9 — Bitget Spot Auth: HMAC-SHA256 (see Section I) | Endpoint | Method | Auth | Purpose | | ------------------------------------- | ------ | ---- | ----------------------------------------- | | /api/v2/spot/trade/place-order | POST | Yes | Place order | | /api/v2/spot/trade/cancel-order | POST | Yes | Cancel order (NOTE: uses POST not DELETE) | | /api/v2/spot/trade/batch-orders | POST | Yes | Batch place (max 50) | | /api/v2/spot/trade/batch-cancel-order | POST | Yes | Batch cancel | | /api/v2/spot/trade/orderInfo | GET | Yes | Query single order | | /api/v2/spot/trade/unfilled-orders | GET | Yes | Open orders | | /api/v2/spot/trade/history-orders | GET | Yes | Order history | | /api/v2/spot/trade/fills | GET | Yes | Trade fills | | /api/v2/spot/account/assets | GET | Yes | Spot assets | | /api/v2/spot/account/info | GET | Yes | Account info | | /api/v2/spot/market/tickers | GET | No | Tickers | | /api/v2/spot/market/orderbook | GET | No | Order book | | /api/v2/spot/market/candles | GET | No | K-line | | /api/v2/spot/market/fills | GET | No | Recent trades | | /api/v2/account/all-account-balance | GET | Yes | All account balances | **Order params**: symbol ("BTCUSDT" no separator), side (buy/sell), orderType (limit/market), force (gtc/ioc/fok/post_only), price, size, clientOid (idempotency key) --- ## XII. Domain 10 — Smart Money Signals ### Smart Money Trading Signals POST `bapi/.../web/signal/smart-money` Body: `{ "smartSignalType":"", "page":1, "pageSize":100, "chainId":"CT_501" }` Chains: BSC (56), Solana (CT_501) Key fields: direction (buy/sell), smartMoneyCount, alertPrice, currentPrice, maxGain (%), exitRate (%), status (active/timeout/completed) Quality: Higher smartMoneyCount = more reliable. Low exitRate on active = smart money still holding. ### Smart Money Inflow Rank POST `bapi/.../tracker/wallet/token/inflow/rank/query` Body: `{ "chainId":"56", "period":"24h", "tagType":2 }` ### Social Hype Leaderboard GET `bapi/.../pulse/social/hype/rank/leaderboard?chainId=&sentiment=All&targetLanguage=en&timeRange=1` Returns AI-generated multilingual sentiment summaries. --- ## XIII. Domain 11 — Meme Rush ### Meme Rush Rank POST `bapi/.../pulse/rank/list` Body: `{ "chainId":"CT_501", "rankType":10, "limit":40 }` rankType: 10=New (bonding curve) 20=Finalizing 30=Migrated to DEX Protocols: Pump.fun (1001), Four.meme (2001), Moonshot (1010), Raydium (1005-1007), BONK (1008), Flap (2002) Advanced filters: progress (curve %), holdersDevPercent, holdersSniperPercent, devSellPercent, tagDevWashTrading, excludeDevWashTrading ### Meme Exclusive Rank GET `bapi/.../pulse/exclusive/rank/list?chainId=56` Algorithm-scored Top 100 breakout potential memes. ### Topic Rush GET `bapi/.../social-rush/rank/list?chainId=&rankType={10|20|30}&sort={10|20|30}` rankType: 10=Latest 20=Rising (ATH $1k-$20k) 30=Viral (ATH >$20k) --- ## XIV. Domain 12 — PnL Leaderboard GET `bapi/.../market/leaderboard/query?chainId=&period={7d|30d|90d}&tag={ALL|KOL}&pageNo=1&pageSize=25` Filters: PNLMin/Max, winRateMin/Max, txMin/Max, volumeMin/Max Returns: address, realizedPnl, winRate, totalVolume, topEarningTokens[], dailyPNL[] --- ## RPC Health-Aware Failover Per-chain node health map: `{ url, healthy, latencyMs, failCount }` 1. Select: healthy nodes → sort by latency → return lowest 2. All unhealthy: return node with fewest failures (graceful degradation) 3. On success: reset failCount, update latencyMs 4. On failure: failCount++; ≥3 consecutive → mark unhealthy 5. Background probe every 30s: eth_blockNumber to all nodes, 5s timeout --- ## Risk Gates | Condition | Action | | ------------------------------------------------ | ------------------------------------- | | riskLevel=5 OR isHoneypot OR recovery<50% | **BLOCK TRADE** | | tax>10% OR quote failure OR priceImpact>30% | **BLOCK TRADE** | | riskLevel=4 | Strongly discourage, require override | | 5%<tax≤10% OR impact>5% | Warn + confirm | | liquidity<$1k | Strongly discourage | | $1k≤liquidity<$10k | Warn slippage | | Safety score<60 OR checks<3 | Warn, show failed items | | devWashTrading=1 OR devPercent>20% OR sniper>30% | Warn manipulation | | Still on bonding curve | Warn high risk | | Mainnet fund movement | **Require user CONFIRM** | --- ## Workflows **A: Discover → Verify → Execute**: Search → market data → 10-point safety scoring → honeypot sim → balance check → smart route quote → user CONFIRM → exact-amount approve → execute → track **B: Portfolio Analysis**: Balance query → enrich holdings → flag risk → suggest actions **C: Signal-Driven**: Smart money signals → inflow rank → safety filter → watchlist → execute via A **D: CEX Spot**: Select exchange (Binance/Gate/Bitget) → validate params → mainnet CONFIRM → place order → status. Cross-CEX price comparison **E: Meme Sniping**: Monitor rankType=10 → filter wash/social → 70-90% curve → smart money cross-ref → safety score → execute via A **F: Copy-Trading**: PnL leaderboard → filter winRate>60% → query positions → cross-ref signals → research → report **G: Topic Narrative**: Viral topics → AI summaries → lead tokens → quality verify → execute via A --- ## Error Handling | Source | Code | Meaning | Action | | ------------ | ------------- | ----------------- | ------------------------------------ | | OKX | 50011 | Rate limited | Exponential backoff + jitter | | OKX | 81104 | Chain unsupported | Check /supported/chain | | OKX | 81451 | Node failed | Check gas/nonce/revert | | Binance Spot | -1021 | Timestamp drift | Sync clock | | Binance Spot | -2010 | Order rejected | Check balance/permissions | | Gate.io | 401 | Auth failed | Verify KEY + SIGN | | Gate.io | 429 | Rate limited | Check X-Gate-RateLimit headers | | Bitget | 401 | Auth failed | Verify KEY + SIGN + timestamp (±10s) | | Solana | 0xb | Wrong address | Use native SOL address | | EVM | nonce too low | Already mined | Fetch latest nonce | **Timeout**: All APIs 10s timeout. On broadcast/order timeout → **check status before retry** (prevent double-spend). --- ## Core Rules **Security**: Never output raw keys. Approve only required amounts. Mainnet ops require CONFIRM. Quote failure = block. See §XVI–§XVII for full credential handling rules. **Units**: APIs use minimal units (wei/lamports); display uses UI units. amount_min = amount_ui × 10^decimal. **Formats**: Gate.io uses underscore pairs "BTC_USDT"; Bitget uses no separator "BTCUSDT". **Fallback**: OKX search ↔ Binance search, OKX candles ↔ Sintral K-line, OKX balance ↔ Binance positions. CEX failure → suggest alternative exchange. **RPC**: Auto-failover via health manager. 30s probe, 5s timeout, 3 consecutive failures = unhealthy. **Output**: Concise decision summaries → risk flags first → blocked trades get reason + alternatives → disclaimer at end. **Defaults**: slippage=1% | ranking pageSize=20-50 | signals=active only | meme default=rankType=20 (migration) | PnL=30d | V3 fee=3000 | tx deadline=300s --- ## XVI. Credential & Environment Variable Registry This skill requires credentials for 5 providers. Below is the **complete registry** of all environment variables, their purpose, and security classification. ### Required Environment Variables | Variable | Provider | Purpose | Sensitivity | | ---------------------- | ----------------- | ------------------------ | ----------- | | `OKX_API_KEY` | OKX DEX | HMAC signing (key) | 🔴 Secret | | `OKX_SECRET_KEY` | OKX DEX | HMAC signing (secret) | 🔴 Secret | | `OKX_PASSPHRASE` | OKX DEX | API passphrase | 🔴 Secret | | `BINANCE_API_KEY` | Binance Spot | Request header auth | 🔴 Secret | | `BINANCE_SECRET_KEY` | Binance Spot | HMAC signing | 🔴 Secret | | `GATE_API_KEY` | Gate.io | Request header auth | 🔴 Secret | | `GATE_SECRET_KEY` | Gate.io | HMAC-SHA512 signing | 🔴 Secret | | `BITGET_API_KEY` | Bitget | Request header auth | 🔴 Secret | | `BITGET_SECRET_KEY` | Bitget | HMAC signing | 🔴 Secret | | `BITGET_PASSPHRASE` | Bitget | API passphrase | 🔴 Secret | | `RPC_ETH` | Ethereum RPC | Chain interaction | 🟡 Sensitive | | `RPC_BSC` | BSC RPC | Chain interaction | 🟡 Sensitive | | `RPC_BASE` | Base RPC | Chain interaction | 🟡 Sensitive | | `RPC_ARB` | Arbitrum RPC | Chain interaction | 🟡 Sensitive | | `RPC_SOL` | Solana RPC | Chain interaction | 🟡 Sensitive | | `DEPLOYER_PRIVATE_KEY` | EVM tx signing | On-chain trade execution | 🔴 Critical | | `SOL_PRIVATE_KEY` | Solana tx signing | On-chain trade execution | 🔴 Critical | | `VAULT_TIMEOUT_MS` | Vault | Auto-lock duration | ⚪ Config | | `ENABLE_TESTNET` | Routing | Route through testnets | ⚪ Config | ### Sensitivity Levels ``` ⚪ Config: Safe to commit to .env.example as placeholder values 🟡 Sensitive: Must be in .env (gitignored), contains API keys or RPC endpoints with keys 🔴 Secret: Must NEVER appear in logs, code, or git history 🔴 Critical: Private keys — highest security; compromise = total fund loss ``` ### Agent Behavior: When to Request Credentials ``` Rule 1: NEVER invent, generate, or hardcode real API keys or secrets. Use placeholder values in .env.example only. Rule 2: When scaffolding, create .env.example with descriptive placeholders: OKX_API_KEY=your-okx-api-key OKX_SECRET_KEY=your-okx-secret-key DEPLOYER_PRIVATE_KEY=0x_DO_NOT_COMMIT_REAL_KEY Rule 3: Add .env to .gitignore BEFORE any .env file is created. Rule 4: When a feature needs a credential not yet configured: → Tell the user which variable is needed and which provider dashboard to get it from → Provide the provider's API key management URL: - OKX: https://www.okx.com/account/my-api - Binance: https://www.binance.com/en/my/settings/api-management - Gate.io: https://www.gate.io/myaccount/apikeys - Bitget: https://www.bitget.com/account/newapi - Alchemy (RPC): https://dashboard.alchemy.com → Ask the user to set it in .env → NEVER ask the user to paste secrets into chat Rule 5: For DEPLOYER_PRIVATE_KEY / SOL_PRIVATE_KEY: → Recommend generating locally (cast wallet new, solana-keygen new) → For mainnet: use hardware wallet or the project Vault system → NEVER use a funded mainnet key in .env on a dev machine Rule 6: When implementing auth signing functions: → Load secrets with process.env.* at module init → Validate presence at startup: if (!key) throw new Error('Missing OKX_API_KEY') → NEVER pass secrets as function parameters through the call stack Rule 7: Agent Scope Limits (Infrastructure): → The agent runs purely as a trading helper. Infrastructure secrets (e.g., DATABASE_URL, REDIS_URL, JWT_SECRET) are EXPLICITLY OUT OF SCOPE. → NEVER attempt to read, request, or persist data directly using backend services. → All state must be passed through safe API layers, never via direct DB connections. ``` --- ## XVII. Security: Agent Rules for Sensitive Key Handling Mandatory rules for any AI agent following this skill when handling API keys, private keys, and credential material during development, testing, and deployment. ### Agent MUST Rules (Non-Negotiable) ``` 1. NEVER echo, log, print, or return API keys/secrets to stdout, stderr, or chat. Masking rule: key.slice(0,4) + '****' + key.slice(-4) 2. NEVER include real secrets in code, comments, commit messages, or artifacts. 3. NEVER store secrets in source-controlled files. Only .env (which MUST be in .gitignore) may contain real credentials. 4. NEVER transmit secrets over unencrypted channels or embed in URLs. 5. When writing HMAC signing utilities: → Secret key MUST come from process.env exclusively → The signing function MUST NOT log the computed signature in production → Timestamp synchronization: use server time diff calibration 6. When writing trade execution code: → Private keys MUST be decrypted from Vault at execution time only → Zero-fill key Buffer after use: keyBuffer.fill(0) → NEVER cache decrypted private keys in global scope 7. When writing Docker/CI configs: → Use secrets managers (Docker secrets, GitHub Actions secrets) → NEVER bake API keys into Docker images or CI YAML 8. When implementing CEX API clients: → Use IP whitelisting where the exchange supports it (all 4 do) → Enable TRADE-ONLY permissions — WITHDRAWAL PERMISSION MUST BE DISABLED on all keys → Implement separate key pairs for spot vs futures (Gate.io requirement) → Verify no withdrawal permission is enabled before any integration test 9. Principle of Least Privilege enforcement: → OKX: Read + Trade. Withdrawal = OFF. IP whitelist = REQUIRED. → Binance: Read + Trade. Withdrawal = OFF. Margin = OFF unless explicitly needed. → Gate.io: Spot trade only. Futures = SEPARATE key. Withdrawal = OFF. → Bitget: Read + Trade. Withdrawal = OFF. IP whitelist recommended. → EVM key: Dedicated wallet, minimal balance, never a primary wallet. → SOL key: Dedicated wallet, minimal balance, never a primary wallet. 10. Testnet-first mandate: → Set ENABLE_TESTNET=true and test ALL workflows on testnets BEFORE mainnet. → Binance testnet: testnet.binance.vision → Only after successful testnet validation may the agent proceed to mainnet. ``` ### Exchange-Specific Security Notes | Exchange | Key Rotation | IP Whitelist | Permission Granularity | Notes | | -------- | ------------------ | ---------------------- | -------------------------------------- | ----------------------------------------------- | | OKX | 90-day recommended | ✅ Required for trade | Read / Trade / Withdraw | Passphrase adds extra layer | | Binance | No expiry, manual | ✅ Strongly recommended | Read / Trade / Withdraw / Margin | Enable HMAC-only (no Ed25519) for compatibility | | Gate.io | No expiry, manual | ✅ Available | Spot / Futures / Withdrawal (separate) | Spot and Futures need SEPARATE key pairs | | Bitget | No expiry, manual | ✅ Available | Read / Trade / Withdraw | Passphrase required; ±10s timestamp tolerance | ### Credential Lifecycle ``` ┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐ │ GENERATION │───▶│ STORAGE │───▶│ USAGE │ │ │ │ │ │ │ │ Exchange UI │ │ .env file (dev) │ │ process.env.* │ │ cast wallet new │ │ Vault (prod) │ │ Vault decrypt │ │ solana-keygen │ │ Docker secrets │ │ HMAC sign() │ └──────────────────┘ └──────────────────┘ └───────┬──────────┘ │ │ ┌─────▼──────┐ ┌──────▼─────┐ │ ROTATION │ │ CLEANUP │ │ API: 90d │ │ Zero-fill │ │ JWT: 15m │ │ Buffer │ │ Refresh:7d │ │ after use │ └────────────┘ └────────────┘ ``` ### .env.example Template The agent MUST generate this file when scaffolding a project using this skill: ```bash # === OKX DEX Aggregator (https://www.okx.com/account/my-api) === OKX_API_KEY=your-okx-api-key OKX_SECRET_KEY=your-okx-secret-key OKX_PASSPHRASE=your-okx-passphrase # === Binance Spot (https://www.binance.com/en/my/settings/api-management) === BINANCE_API_KEY=your-binance-api-key BINANCE_SECRET_KEY=your-binance-secret-key # === Gate.io Spot (https://www.gate.io/myaccount/apikeys) === # NOTE: Spot and Futures require SEPARATE key pairs GATE_API_KEY=your-gate-spot-api-key GATE_SECRET_KEY=your-gate-spot-secret-key # === Bitget Spot (https://www.bitget.com/account/newapi) === BITGET_API_KEY=your-bitget-api-key BITGET_SECRET_KEY=your-bitget-secret-key BITGET_PASSPHRASE=your-bitget-passphrase # === Blockchain RPC (https://dashboard.alchemy.com) === RPC_ETH=https://eth-mainnet.g.alchemy.com/v2/YOUR_KEY RPC_BSC=https://bsc-dataseed1.binance.org RPC_BASE=https://base-mainnet.g.alchemy.com/v2/YOUR_KEY RPC_ARB=https://arb-mainnet.g.alchemy.com/v2/YOUR_KEY RPC_SOL=https://api.mainnet-beta.solana.com # === On-Chain Signing (NEVER commit funded mainnet keys) === # Generate a fresh dedicated wallet: cast wallet new (EVM) | solana-keygen new (Solana) # Use a SMALL-BALANCE ONLY wallet. NEVER use a primary/funded mainnet wallet here. DEPLOYER_PRIVATE_KEY= # ↑ Leave blank. Populate ONLY with a freshly generated, isolated dev/test wallet key. SOL_PRIVATE_KEY= # ↑ Leave blank. Base58 key — generate with: solana-keygen new --no-bip39-passphrase # === Infrastructure === # NOTE: Trade_Tool backend services manage their own standalone configuration. # Infrastructure secrets (DB, Redis, JWT) are completely isolated from this agent skill. VAULT_TIMEOUT_MS=28800000 ENABLE_TESTNET=true ``` --- ## XVIII. Pre-Install Security Checklist Before activating this skill with live credentials, verify every item below: | # | Check | Status | | --- | ---------------------------------------------------------------------------------------------------------------------------------- | ------ | | 1 | **Testnet first** — `ENABLE_TESTNET=true` tested successfully before mainnet | ☐ | | 2 | **Dedicated wallets** — `DEPLOYER_PRIVATE_KEY` / `SOL_PRIVATE_KEY` are fresh wallets with minimal balance, not your primary wallet | ☐ | | 3 | **Withdrawal disabled** — All CEX API keys (OKX / Binance / Gate / Bitget) have withdrawal permission explicitly OFF | ☐ | | 4 | **IP whitelist enabled** — All exchange API keys locked to your server's IP address | ☐ | | 5 | **Trade-only scope** — No Margin, Futures, or Cross-account permissions granted unless required | ☐ | | 6 | **Secrets in .env only** — Credentials stored in `.env` (gitignored), never in source code or chat | ☐ | | 7 | **Vault for mainnet** — Production keys stored in the project Vault system, not plain `.env` | ☐ | | 8 | **Provenance verified** — Skill source confirmed at `https://github.com/StanPoldark/Trade_Tool` | ☐ | | 9 | **Metadata in sync** — `requiredEnv` in YAML frontmatter matches §XVI table (verify: diff the `name:` fields in the YAML block against the §XVI Variable column, zero delta expected) | ☐ | | 10 | **Small balance test** — First mainnet trade uses smallest viable amount to validate integration | ☐ | > **How to use**: Copy this checklist into your project's `SECURITY.md` and confirm each item before > going live. Skip any item only if that provider is not used in your deployment. --- ⚠️ This skill provides operational reference only and does not constitute investment advice. Always DYOR.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)