back
loading skill details...
Universal Web3 & Crypto operating skill for AI agents. 12 domains, 60+ API endpoints, 5 providers: OKX DEX aggregator, Binance Web3 intelligence, Binance/Gat...
---
name: web3-crypto-ops
description: >
Universal Web3 & Crypto operating skill for AI agents. 12 domains, 60+ API endpoints,
5 providers: OKX DEX aggregator, Binance Web3 intelligence, Binance/Gate.io/Bitget Spot.
Production-grade patterns: RPC health failover, 10-point token safety scoring, honeypot
round-trip simulation, V2/V3 smart routing, direct pool turbo execution, Pump.fun/Jupiter
auto-dispatch. Commercial risk gates and compliance controls built-in.
license: Apache-2.0
# ── Invocation policy ───────────────────────────────────────────────────────
# always:false → skill is user-invocable only; NOT silently auto-triggered.
# Platform must prompt the user before any mainnet fund movement.
always: false
metadata:
version: "1.0.3"
tags: [web3, crypto, dex, cex, swap, portfolio, audit, smart-money, meme, signals, gate, bitget]
categories: [trading, defi, analytics, security, market-intelligence]
compatibility: [openclaw, gemini-cli]
providers: [okx-dex, binance-web3, binance-spot, gate-spot, bitget-spot]
chains: [ethereum, bsc, solana, base, arbitrum, polygon, xlayer]
# ── Required environment variables (surfaced to platform registry) ───────────
# CRITICAL: This block MUST match §XVI of the skill body exactly.
# A mismatch between this list and §XVI is a security red flag — keep in sync.
requiredEnv:
# ── CEX API keys (trade-only, NO withdrawal permission) ──
- OKX_API_KEY
- OKX_SECRET_KEY
- OKX_PASSPHRASE
- BINANCE_API_KEY
- BINANCE_SECRET_KEY
- GATE_API_KEY
- GATE_SECRET_KEY
- BITGET_API_KEY
- BITGET_SECRET_KEY
- BITGET_PASSPHRASE
# ── Blockchain RPC endpoints ──
- RPC_ETH
- RPC_BSC
- RPC_BASE
- RPC_ARB
- RPC_SOL
# ── On-chain signing keys (CRITICAL — highest privilege) ──
- DEPLOYER_PRIVATE_KEY
- SOL_PRIVATE_KEY
# ── Feature flags & configs ──
- VAULT_TIMEOUT_MS
- ENABLE_TESTNET
---
# Web3 Crypto Ops v3.0.0
## Trigger Phrases
Token search / trending / rankings | Price / K-line / charts | Security audit / honeypot scan |
Wallet balance / holdings | DEX swap / on-chain trade | Gas estimate / broadcast / track |
Binance / Gate / Bitget spot order | Smart money signals / social hype |
Meme Rush / Pump.fun / Four.meme | PnL leaderboard / KOL tracking
---
## I. Authentication
> **⚠️ SECURITY**: All credentials below are 🔴 Secret-level. They MUST be loaded from
> environment variables via `process.env.*`, NEVER hardcoded in source, logged, or
> transmitted in chat. See §XVI for the complete credential registry and agent rules.
### OKX (HMAC-SHA256)
```
Headers: OK-ACCESS-KEY, OK-ACCESS-SIGN, OK-ACCESS-PASSPHRASE, OK-ACCESS-TIMESTAMP
SIGN = Base64(HMAC-SHA256(timestamp+method+requestPath+body, SECRET))
GET: body="", requestPath includes queryString
POST: body=JSON, requestPath is path only
Env: OKX_API_KEY, OKX_SECRET_KEY, OKX_PASSPHRASE
```
### Binance Spot (HMAC-SHA256)
```
Header: X-MBX-APIKEY
Query: timestamp(ms) + signature=HMAC-SHA256(queryString, secret)
Mainnet: api.binance.com | Testnet: testnet.binance.vision
Env: BINANCE_API_KEY, BINANCE_SECRET_KEY
```
### Gate.io v4 (HMAC-SHA512)
```
Headers: KEY, Timestamp(seconds), SIGN
SIGN = HMAC-SHA512(secret, METHOD\n/api/v4/path\nqueryString\nSHA512(body)\ntimestamp)
Base: api.gateio.ws/api/v4
Env: GATE_API_KEY, GATE_SECRET_KEY
Rate limit: 900 req/s (private spot)
Note: Spot and Futures use SEPARATE API key pairs
```
### Bitget v2 (HMAC-SHA256)
```
Headers: ACCESS-KEY, ACCESS-SIGN, ACCESS-TIMESTAMP(ms), ACCESS-PASSPHRASE
SIGN = Base64(HMAC-SHA256(timestamp+METHOD+path+body, SECRET))
With queryString: timestamp+METHOD+path+?+queryString+body
Base: api.bitget.com
Env: BITGET_API_KEY, BITGET_SECRET_KEY, BITGET_PASSPHRASE
Note: Timestamp drift must be within ±10 seconds
```
### Binance Web3 (No Auth)
```
Public endpoints. Required header: Accept-Encoding: identity
POST also needs: Content-Type: application/json
Base: web3.binance.com
Warning: /bapi/defi/* are undocumented APIs — may change without notice, implement fallback
```
---
## II. Chain ID Mapping
| Chain | OKX | Binance | K-Line Platform | Native Token Address |
| -------- | ----- | ------- | --------------- | -------------------------------- |
| Ethereum | 1 | 1 | eth | 0xeeee...eeee |
| BSC | 56 | 56 | bsc | 0xeeee...eeee |
| Solana | 501 | CT_501 | solana | 11111111111111111111111111111111 |
| Base | 8453 | 8453 | base | 0xeeee...eeee |
| Arbitrum | 42161 | — | — | 0xeeee...eeee |
| Polygon | 137 | — | — | 0xeeee...eeee |
**CRITICAL**: Solana native SOL uses `11111111111111111111111111111111`. Do NOT use wSOL (`So111...112`) — causes `custom program error: 0xb`.
Exception: candles and trades endpoints require the wSOL address. Binance Solana chainId is `CT_501`, not `501`.
**Wrapped Native**: BSC `0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c` | ETH `0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2` | Base `0x4200000000000000000000000000000000000006`
---
## III. Domain 1 — Token Discovery
| API | Method | Path | Purpose |
| -------------------- | ------ | ------------------------------------------------------------------------- | ----------------------------------------- |
| OKX Search | GET | /api/v6/dex/market/token/search?chains=&search= | Search by name/symbol/address |
| OKX Ranking | GET | /api/v6/dex/market/token/toplist?chains=&sortBy={2\|5\|6}&timeFrame={1-4} | Rank by change/volume/mcap |
| OKX Basic Info | POST | /api/v6/dex/market/token/basic-info | Batch metadata |
| OKX Holders | GET | /api/v6/dex/market/token/holder?chainIndex=&tokenContractAddress= | Top 20 holder distribution |
| Binance Search | GET | bapi/.../market/token/search?keyword=&chainIds=&orderBy=volume24h | Alternative search source |
| Binance Unified Rank | POST | bapi/.../pulse/unified/rank/list | Trending/Alpha/Stock ranking with filters |
Unified Rank rankType: 10=Trending 11=Top Search 20=Alpha 40=Stock
period: 10=1m 20=5m 30=1h 40=4h 50=24h
sortBy: 40=marketCap 50=priceChange 70=volume 100=uniqueTraders
---
## IV. Domain 2 — Market Data
| API | Method | Path | Returns |
| ------------------ | -------- | ------------------------------------------------------------------------ | --------------------------------------------------- |
| OKX Price Info | POST | /api/v6/dex/market/price-info | price, marketCap, liquidity, volume24H, priceChange |
| OKX Realtime Price | POST | /api/v6/dex/market/price | price (USD) |
| OKX Candles | GET | /api/v6/dex/market/candles?bar={interval}&limit= | [ts,o,h,l,c,vol,volUsd,confirm] |
| OKX Historical | GET | /api/v6/dex/market/historical-candles | Same format, older data |
| OKX Trades | GET | /api/v6/dex/market/trades | type, price, volume, dexName |
| OKX Index | POST/GET | /api/v6/dex/index/current-price \| historical-price | Multi-source aggregated price |
| Binance Dynamic | GET | bapi/.../token/dynamic/info?chainId=&contractAddress= | price, fdv, kolHolders, smartMoneyHolders |
| Binance Metadata | GET | bapi/.../token/meta/info?chainId=&contractAddress= | creatorAddress, links, auditInfo |
| Binance K-Line | GET | dquery.sintral.io/u-kline/v1/k-line/candles?platform=&address=&interval= | [o,h,l,c,vol,ts,count] |
Intervals: 1s, 1m, 3m, 5m, 15m, 30m, 1H, 2H, 4H, 6H, 12H, 1D, 1W, 1M, 3M
---
## V. Domain 3 — Security Audit & Safety Scoring
### Binance Token Audit
POST `bapi/.../security/token/audit`
Body: `{ "binanceChainId": "56|8453|CT_501|1", "contractAddress": "...", "requestId": "uuid" }`
**Results valid ONLY when hasResult=true AND isSupported=true**
riskLevel: 0-1=LOW 2-3=MEDIUM 4=HIGH 5=**BLOCK TRADE**
### Production 10-Point Safety Scoring
| # | Check | Safe Threshold |
| --- | -------------------------- | -------------- |
| 1 | LP Lock Rate | ≥80% |
| 2 | Top10 Holder Concentration | ≤45% |
| 3 | Liquidity (USD) | ≥$15,000 |
| 4 | Market Cap (USD) | ≥$20,000 |
| 5 | Holder Count | ≥150 |
| 6 | Insider Holding % | ≤10% |
| 7 | Sniper Holding % | ≤8% |
| 8 | 24h Transaction Count | ≥80 |
| 9 | Dev Rug-Pull History | = 0 |
| 10 | Dev Coins Launched | ≤5 |
Score = passedCount / totalChecks × 100. Pass requires: all checks passed AND totalChecks ≥ 3.
### Honeypot Detection (Round-Trip Simulation)
1. Simulate BUY: WNATIVE → Token (record amountOut)
2. Simulate SELL: Token → WNATIVE (use amountOut as input)
3. Recovery ratio = sellOut / originalAmount × 100
4. <50% = honeypot (85% confidence) | =0 = honeypot (90%) | 50-80% = suspicious | >80% = normal
### Contract Risk Flags
isHoneypot → **BLOCK** | hasMintMethod → HIGH risk | isLpNotLocked → Rug risk | hasNotRenounced → MEDIUM | isInBlacklist → MEDIUM
---
## VI. Domain 4 — Wallet & Portfolio
| API | Method | Path |
| ----------------- | ------ | -------------------------------------------------------------------- |
| OKX Total Value | GET | /api/v6/dex/balance/total-value-by-address?address=&chains= |
| OKX All Balances | GET | /api/v6/dex/balance/all-token-balances-by-address?address=&chains= |
| OKX Token Balance | POST | /api/v6/dex/balance/token-balances-by-address |
| Binance Positions | GET | bapi/.../address/pnl/active-position-list?address=&chainId=&offset=0 |
Note: OKX excludeRiskToken is Boolean for total-value but String("0"/"1") for token-balances.
Native token: tokenContractAddress = "" (empty string).
---
## VII. Domain 5 — DEX Swap Execution
### OKX Aggregator (all GET)
| Endpoint | Purpose |
| ------------------------------------------------------------------------------------------- | -------------------------------- |
| /api/v6/dex/aggregator/quote?chainIndex=&fromTokenAddress=&toTokenAddress=&amount= | Get quote |
| /api/v6/dex/aggregator/approve-transaction?chainIndex=&tokenContractAddress=&approveAmount= | ERC20 approval |
| /api/v6/dex/aggregator/swap?chainIndex=&...&slippagePercent=1&userWalletAddress= | Swap calldata |
| /api/v6/dex/aggregator/swap-instruction?chainIndex=501&... | Solana deserialized instructions |
Amount must be in minimal units (wei/lamports). Default slippage: 1%.
### Smart Router (V2/V3 Auto-Selection)
Query all routes in parallel → pick highest amountOut:
1. V2 Router `getAmountsOut(amountIn, [tokenIn, tokenOut])`
2. V3 Quoter `quoteExactInputSingle` across ALL fee tiers (100, 500, 3000, 10000)
3. Sort by amountOut descending → select best
**V2 Routers**: BSC `0x10ED43C718714eb63d5aA57B78B54704E256024E` | ETH `0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D` | Base `0x4752ba5DBc23f44D87826276BF6Fd6b1C372aD24`
**V3 Routers**: ETH `0xE592427A0AEce92De3Edee1F18E0157C05861564` | Base `0x2626664c2603336E57B271c5C0b26F421741e481` | BSC `0x13f4EA83D0bd40E75C8222255bc855a974568Dd4`
**V3 Fees**: 100 (0.01% stables), 500 (0.05%), 3000 (0.3% most pairs), 10000 (1% exotic)
### Turbo Direct Pool (~15k-30k gas savings)
Bypass router, call pool contracts directly:
- V2: transfer token to pair → pair.swap(amount0Out, amount1Out, to, 0x)
- V3: fallback to SwapRouter exactInputSingle (EOA can't call pool.swap callback)
- V2 formula: `amountOut = amountIn×997×reserveOut / (reserveIn×1000 + amountIn×997)`
### Solana Auto-Dispatch
isPumpToken? → Pump.fun direct buy/sell : Jupiter aggregator
### Safety Patterns
- Approve ONLY required amount — **never maxUint256**
- Quote failure → **BLOCK trade** (prevents sandwich attacks)
- Slippage: `amountOutMin = expectedOut × (10000 - slippageBps) / 10000`
---
## VIII. Domain 6 — Broadcast & Tracking
| Endpoint | Method | Purpose |
| -------------------------------------------------------- | ------ | --------------------- |
| /api/v6/dex/pre-transaction/gas-price?chainIndex= | GET | Gas price |
| /api/v6/dex/pre-transaction/gas-limit | POST | Gas limit estimate |
| /api/v6/dex/pre-transaction/simulate | POST | Tx simulation |
| /api/v6/dex/pre-transaction/broadcast-transaction | POST | Broadcast signed tx |
| /api/v6/dex/post-transaction/orders?address=&chainIndex= | GET | Order status tracking |
Broadcast body: `{ "signedTx": "0x...", "chainIndex": "1", "address": "0x..." }`
MEV protection: `extraData: { "enableMevProtection": true }` (ETH/BSC/SOL/BASE)
txStatus: 1=Pending 2=Success 3=Failed
---
## IX. Domain 7 — Binance Spot
| Endpoint | Method | Purpose |
| -------------------- | ------ | -------------------- |
| /api/v3/order | POST | Place order |
| /api/v3/order | GET | Query order |
| /api/v3/order | DELETE | Cancel order |
| /api/v3/order/test | POST | Test order (no exec) |
| /api/v3/openOrders | GET | Open orders |
| /api/v3/account | GET | Account info |
| /api/v3/myTrades | GET | Trade history |
| /api/v3/ticker/price | GET | Ticker |
| /api/v3/klines | GET | K-line |
| /api/v3/depth | GET | Order book |
Order types: MARKET, LIMIT, STOP_LOSS, STOP_LOSS_LIMIT, TAKE_PROFIT, TAKE_PROFIT_LIMIT, LIMIT_MAKER
Advanced: OCO, OTO, OTOCO conditional orders
---
## X. Domain 8 — Gate.io Spot
Auth: HMAC-SHA512 (see Section I)
| Endpoint | Method | Auth | Purpose |
| ----------------------- | ------ | ---- | ------------------------------------------- |
| /spot/orders | POST | Yes | Create order |
| /spot/orders | GET | Yes | List orders (params: status, market, limit) |
| /spot/orders/{order_id} | GET | Yes | Get single order |
| /spot/orders/{order_id} | DELETE | Yes | Cancel single order |
| /spot/orders | DELETE | Yes | Cancel all orders |
| /spot/accounts | GET | Yes | Spot balance |
| /spot/tickers | GET | No | Tickers |
| /spot/order_book | GET | No | Order book |
| /spot/candlesticks | GET | No | K-line |
| /spot/currency_pairs | GET | No | Trading pair rules |
| /wallet/total_balance | GET | Yes | Total balance across all accounts |
**Order params**: currency_pair ("BTC_USDT" underscore format), side (buy/sell), type (limit/market), amount, price, time_in_force (gtc/ioc/poc/fok), account ("spot")
Rate limit headers: `X-Gate-RateLimit-Requests-Remain`, `X-Gate-RateLimit-Limit`
---
## XI. Domain 9 — Bitget Spot
Auth: HMAC-SHA256 (see Section I)
| Endpoint | Method | Auth | Purpose |
| ------------------------------------- | ------ | ---- | ----------------------------------------- |
| /api/v2/spot/trade/place-order | POST | Yes | Place order |
| /api/v2/spot/trade/cancel-order | POST | Yes | Cancel order (NOTE: uses POST not DELETE) |
| /api/v2/spot/trade/batch-orders | POST | Yes | Batch place (max 50) |
| /api/v2/spot/trade/batch-cancel-order | POST | Yes | Batch cancel |
| /api/v2/spot/trade/orderInfo | GET | Yes | Query single order |
| /api/v2/spot/trade/unfilled-orders | GET | Yes | Open orders |
| /api/v2/spot/trade/history-orders | GET | Yes | Order history |
| /api/v2/spot/trade/fills | GET | Yes | Trade fills |
| /api/v2/spot/account/assets | GET | Yes | Spot assets |
| /api/v2/spot/account/info | GET | Yes | Account info |
| /api/v2/spot/market/tickers | GET | No | Tickers |
| /api/v2/spot/market/orderbook | GET | No | Order book |
| /api/v2/spot/market/candles | GET | No | K-line |
| /api/v2/spot/market/fills | GET | No | Recent trades |
| /api/v2/account/all-account-balance | GET | Yes | All account balances |
**Order params**: symbol ("BTCUSDT" no separator), side (buy/sell), orderType (limit/market), force (gtc/ioc/fok/post_only), price, size, clientOid (idempotency key)
---
## XII. Domain 10 — Smart Money Signals
### Smart Money Trading Signals
POST `bapi/.../web/signal/smart-money`
Body: `{ "smartSignalType":"", "page":1, "pageSize":100, "chainId":"CT_501" }`
Chains: BSC (56), Solana (CT_501)
Key fields: direction (buy/sell), smartMoneyCount, alertPrice, currentPrice, maxGain (%), exitRate (%), status (active/timeout/completed)
Quality: Higher smartMoneyCount = more reliable. Low exitRate on active = smart money still holding.
### Smart Money Inflow Rank
POST `bapi/.../tracker/wallet/token/inflow/rank/query`
Body: `{ "chainId":"56", "period":"24h", "tagType":2 }`
### Social Hype Leaderboard
GET `bapi/.../pulse/social/hype/rank/leaderboard?chainId=&sentiment=All&targetLanguage=en&timeRange=1`
Returns AI-generated multilingual sentiment summaries.
---
## XIII. Domain 11 — Meme Rush
### Meme Rush Rank
POST `bapi/.../pulse/rank/list`
Body: `{ "chainId":"CT_501", "rankType":10, "limit":40 }`
rankType: 10=New (bonding curve) 20=Finalizing 30=Migrated to DEX
Protocols: Pump.fun (1001), Four.meme (2001), Moonshot (1010), Raydium (1005-1007), BONK (1008), Flap (2002)
Advanced filters: progress (curve %), holdersDevPercent, holdersSniperPercent, devSellPercent, tagDevWashTrading, excludeDevWashTrading
### Meme Exclusive Rank
GET `bapi/.../pulse/exclusive/rank/list?chainId=56`
Algorithm-scored Top 100 breakout potential memes.
### Topic Rush
GET `bapi/.../social-rush/rank/list?chainId=&rankType={10|20|30}&sort={10|20|30}`
rankType: 10=Latest 20=Rising (ATH $1k-$20k) 30=Viral (ATH >$20k)
---
## XIV. Domain 12 — PnL Leaderboard
GET `bapi/.../market/leaderboard/query?chainId=&period={7d|30d|90d}&tag={ALL|KOL}&pageNo=1&pageSize=25`
Filters: PNLMin/Max, winRateMin/Max, txMin/Max, volumeMin/Max
Returns: address, realizedPnl, winRate, totalVolume, topEarningTokens[], dailyPNL[]
---
## RPC Health-Aware Failover
Per-chain node health map: `{ url, healthy, latencyMs, failCount }`
1. Select: healthy nodes → sort by latency → return lowest
2. All unhealthy: return node with fewest failures (graceful degradation)
3. On success: reset failCount, update latencyMs
4. On failure: failCount++; ≥3 consecutive → mark unhealthy
5. Background probe every 30s: eth_blockNumber to all nodes, 5s timeout
---
## Risk Gates
| Condition | Action |
| ------------------------------------------------ | ------------------------------------- |
| riskLevel=5 OR isHoneypot OR recovery<50% | **BLOCK TRADE** |
| tax>10% OR quote failure OR priceImpact>30% | **BLOCK TRADE** |
| riskLevel=4 | Strongly discourage, require override |
| 5%<tax≤10% OR impact>5% | Warn + confirm |
| liquidity<$1k | Strongly discourage |
| $1k≤liquidity<$10k | Warn slippage |
| Safety score<60 OR checks<3 | Warn, show failed items |
| devWashTrading=1 OR devPercent>20% OR sniper>30% | Warn manipulation |
| Still on bonding curve | Warn high risk |
| Mainnet fund movement | **Require user CONFIRM** |
---
## Workflows
**A: Discover → Verify → Execute**: Search → market data → 10-point safety scoring → honeypot sim → balance check → smart route quote → user CONFIRM → exact-amount approve → execute → track
**B: Portfolio Analysis**: Balance query → enrich holdings → flag risk → suggest actions
**C: Signal-Driven**: Smart money signals → inflow rank → safety filter → watchlist → execute via A
**D: CEX Spot**: Select exchange (Binance/Gate/Bitget) → validate params → mainnet CONFIRM → place order → status. Cross-CEX price comparison
**E: Meme Sniping**: Monitor rankType=10 → filter wash/social → 70-90% curve → smart money cross-ref → safety score → execute via A
**F: Copy-Trading**: PnL leaderboard → filter winRate>60% → query positions → cross-ref signals → research → report
**G: Topic Narrative**: Viral topics → AI summaries → lead tokens → quality verify → execute via A
---
## Error Handling
| Source | Code | Meaning | Action |
| ------------ | ------------- | ----------------- | ------------------------------------ |
| OKX | 50011 | Rate limited | Exponential backoff + jitter |
| OKX | 81104 | Chain unsupported | Check /supported/chain |
| OKX | 81451 | Node failed | Check gas/nonce/revert |
| Binance Spot | -1021 | Timestamp drift | Sync clock |
| Binance Spot | -2010 | Order rejected | Check balance/permissions |
| Gate.io | 401 | Auth failed | Verify KEY + SIGN |
| Gate.io | 429 | Rate limited | Check X-Gate-RateLimit headers |
| Bitget | 401 | Auth failed | Verify KEY + SIGN + timestamp (±10s) |
| Solana | 0xb | Wrong address | Use native SOL address |
| EVM | nonce too low | Already mined | Fetch latest nonce |
**Timeout**: All APIs 10s timeout. On broadcast/order timeout → **check status before retry** (prevent double-spend).
---
## Core Rules
**Security**: Never output raw keys. Approve only required amounts. Mainnet ops require CONFIRM. Quote failure = block. See §XVI–§XVII for full credential handling rules.
**Units**: APIs use minimal units (wei/lamports); display uses UI units. amount_min = amount_ui × 10^decimal.
**Formats**: Gate.io uses underscore pairs "BTC_USDT"; Bitget uses no separator "BTCUSDT".
**Fallback**: OKX search ↔ Binance search, OKX candles ↔ Sintral K-line, OKX balance ↔ Binance positions. CEX failure → suggest alternative exchange.
**RPC**: Auto-failover via health manager. 30s probe, 5s timeout, 3 consecutive failures = unhealthy.
**Output**: Concise decision summaries → risk flags first → blocked trades get reason + alternatives → disclaimer at end.
**Defaults**: slippage=1% | ranking pageSize=20-50 | signals=active only | meme default=rankType=20 (migration) | PnL=30d | V3 fee=3000 | tx deadline=300s
---
## XVI. Credential & Environment Variable Registry
This skill requires credentials for 5 providers. Below is the **complete registry** of all
environment variables, their purpose, and security classification.
### Required Environment Variables
| Variable | Provider | Purpose | Sensitivity |
| ---------------------- | ----------------- | ------------------------ | ----------- |
| `OKX_API_KEY` | OKX DEX | HMAC signing (key) | 🔴 Secret |
| `OKX_SECRET_KEY` | OKX DEX | HMAC signing (secret) | 🔴 Secret |
| `OKX_PASSPHRASE` | OKX DEX | API passphrase | 🔴 Secret |
| `BINANCE_API_KEY` | Binance Spot | Request header auth | 🔴 Secret |
| `BINANCE_SECRET_KEY` | Binance Spot | HMAC signing | 🔴 Secret |
| `GATE_API_KEY` | Gate.io | Request header auth | 🔴 Secret |
| `GATE_SECRET_KEY` | Gate.io | HMAC-SHA512 signing | 🔴 Secret |
| `BITGET_API_KEY` | Bitget | Request header auth | 🔴 Secret |
| `BITGET_SECRET_KEY` | Bitget | HMAC signing | 🔴 Secret |
| `BITGET_PASSPHRASE` | Bitget | API passphrase | 🔴 Secret |
| `RPC_ETH` | Ethereum RPC | Chain interaction | 🟡 Sensitive |
| `RPC_BSC` | BSC RPC | Chain interaction | 🟡 Sensitive |
| `RPC_BASE` | Base RPC | Chain interaction | 🟡 Sensitive |
| `RPC_ARB` | Arbitrum RPC | Chain interaction | 🟡 Sensitive |
| `RPC_SOL` | Solana RPC | Chain interaction | 🟡 Sensitive |
| `DEPLOYER_PRIVATE_KEY` | EVM tx signing | On-chain trade execution | 🔴 Critical |
| `SOL_PRIVATE_KEY` | Solana tx signing | On-chain trade execution | 🔴 Critical |
| `VAULT_TIMEOUT_MS` | Vault | Auto-lock duration | ⚪ Config |
| `ENABLE_TESTNET` | Routing | Route through testnets | ⚪ Config |
### Sensitivity Levels
```
⚪ Config: Safe to commit to .env.example as placeholder values
🟡 Sensitive: Must be in .env (gitignored), contains API keys or RPC endpoints with keys
🔴 Secret: Must NEVER appear in logs, code, or git history
🔴 Critical: Private keys — highest security; compromise = total fund loss
```
### Agent Behavior: When to Request Credentials
```
Rule 1: NEVER invent, generate, or hardcode real API keys or secrets.
Use placeholder values in .env.example only.
Rule 2: When scaffolding, create .env.example with descriptive placeholders:
OKX_API_KEY=your-okx-api-key
OKX_SECRET_KEY=your-okx-secret-key
DEPLOYER_PRIVATE_KEY=0x_DO_NOT_COMMIT_REAL_KEY
Rule 3: Add .env to .gitignore BEFORE any .env file is created.
Rule 4: When a feature needs a credential not yet configured:
→ Tell the user which variable is needed and which provider dashboard to get it from
→ Provide the provider's API key management URL:
- OKX: https://www.okx.com/account/my-api
- Binance: https://www.binance.com/en/my/settings/api-management
- Gate.io: https://www.gate.io/myaccount/apikeys
- Bitget: https://www.bitget.com/account/newapi
- Alchemy (RPC): https://dashboard.alchemy.com
→ Ask the user to set it in .env
→ NEVER ask the user to paste secrets into chat
Rule 5: For DEPLOYER_PRIVATE_KEY / SOL_PRIVATE_KEY:
→ Recommend generating locally (cast wallet new, solana-keygen new)
→ For mainnet: use hardware wallet or the project Vault system
→ NEVER use a funded mainnet key in .env on a dev machine
Rule 6: When implementing auth signing functions:
→ Load secrets with process.env.* at module init
→ Validate presence at startup: if (!key) throw new Error('Missing OKX_API_KEY')
→ NEVER pass secrets as function parameters through the call stack
Rule 7: Agent Scope Limits (Infrastructure):
→ The agent runs purely as a trading helper. Infrastructure secrets
(e.g., DATABASE_URL, REDIS_URL, JWT_SECRET) are EXPLICITLY OUT OF SCOPE.
→ NEVER attempt to read, request, or persist data directly using backend services.
→ All state must be passed through safe API layers, never via direct DB connections.
```
---
## XVII. Security: Agent Rules for Sensitive Key Handling
Mandatory rules for any AI agent following this skill when handling API keys, private keys,
and credential material during development, testing, and deployment.
### Agent MUST Rules (Non-Negotiable)
```
1. NEVER echo, log, print, or return API keys/secrets to stdout, stderr, or chat.
Masking rule: key.slice(0,4) + '****' + key.slice(-4)
2. NEVER include real secrets in code, comments, commit messages, or artifacts.
3. NEVER store secrets in source-controlled files.
Only .env (which MUST be in .gitignore) may contain real credentials.
4. NEVER transmit secrets over unencrypted channels or embed in URLs.
5. When writing HMAC signing utilities:
→ Secret key MUST come from process.env exclusively
→ The signing function MUST NOT log the computed signature in production
→ Timestamp synchronization: use server time diff calibration
6. When writing trade execution code:
→ Private keys MUST be decrypted from Vault at execution time only
→ Zero-fill key Buffer after use: keyBuffer.fill(0)
→ NEVER cache decrypted private keys in global scope
7. When writing Docker/CI configs:
→ Use secrets managers (Docker secrets, GitHub Actions secrets)
→ NEVER bake API keys into Docker images or CI YAML
8. When implementing CEX API clients:
→ Use IP whitelisting where the exchange supports it (all 4 do)
→ Enable TRADE-ONLY permissions — WITHDRAWAL PERMISSION MUST BE DISABLED on all keys
→ Implement separate key pairs for spot vs futures (Gate.io requirement)
→ Verify no withdrawal permission is enabled before any integration test
9. Principle of Least Privilege enforcement:
→ OKX: Read + Trade. Withdrawal = OFF. IP whitelist = REQUIRED.
→ Binance: Read + Trade. Withdrawal = OFF. Margin = OFF unless explicitly needed.
→ Gate.io: Spot trade only. Futures = SEPARATE key. Withdrawal = OFF.
→ Bitget: Read + Trade. Withdrawal = OFF. IP whitelist recommended.
→ EVM key: Dedicated wallet, minimal balance, never a primary wallet.
→ SOL key: Dedicated wallet, minimal balance, never a primary wallet.
10. Testnet-first mandate:
→ Set ENABLE_TESTNET=true and test ALL workflows on testnets BEFORE mainnet.
→ Binance testnet: testnet.binance.vision
→ Only after successful testnet validation may the agent proceed to mainnet.
```
### Exchange-Specific Security Notes
| Exchange | Key Rotation | IP Whitelist | Permission Granularity | Notes |
| -------- | ------------------ | ---------------------- | -------------------------------------- | ----------------------------------------------- |
| OKX | 90-day recommended | ✅ Required for trade | Read / Trade / Withdraw | Passphrase adds extra layer |
| Binance | No expiry, manual | ✅ Strongly recommended | Read / Trade / Withdraw / Margin | Enable HMAC-only (no Ed25519) for compatibility |
| Gate.io | No expiry, manual | ✅ Available | Spot / Futures / Withdrawal (separate) | Spot and Futures need SEPARATE key pairs |
| Bitget | No expiry, manual | ✅ Available | Read / Trade / Withdraw | Passphrase required; ±10s timestamp tolerance |
### Credential Lifecycle
```
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ GENERATION │───▶│ STORAGE │───▶│ USAGE │
│ │ │ │ │ │
│ Exchange UI │ │ .env file (dev) │ │ process.env.* │
│ cast wallet new │ │ Vault (prod) │ │ Vault decrypt │
│ solana-keygen │ │ Docker secrets │ │ HMAC sign() │
└──────────────────┘ └──────────────────┘ └───────┬──────────┘
│ │
┌─────▼──────┐ ┌──────▼─────┐
│ ROTATION │ │ CLEANUP │
│ API: 90d │ │ Zero-fill │
│ JWT: 15m │ │ Buffer │
│ Refresh:7d │ │ after use │
└────────────┘ └────────────┘
```
### .env.example Template
The agent MUST generate this file when scaffolding a project using this skill:
```bash
# === OKX DEX Aggregator (https://www.okx.com/account/my-api) ===
OKX_API_KEY=your-okx-api-key
OKX_SECRET_KEY=your-okx-secret-key
OKX_PASSPHRASE=your-okx-passphrase
# === Binance Spot (https://www.binance.com/en/my/settings/api-management) ===
BINANCE_API_KEY=your-binance-api-key
BINANCE_SECRET_KEY=your-binance-secret-key
# === Gate.io Spot (https://www.gate.io/myaccount/apikeys) ===
# NOTE: Spot and Futures require SEPARATE key pairs
GATE_API_KEY=your-gate-spot-api-key
GATE_SECRET_KEY=your-gate-spot-secret-key
# === Bitget Spot (https://www.bitget.com/account/newapi) ===
BITGET_API_KEY=your-bitget-api-key
BITGET_SECRET_KEY=your-bitget-secret-key
BITGET_PASSPHRASE=your-bitget-passphrase
# === Blockchain RPC (https://dashboard.alchemy.com) ===
RPC_ETH=https://eth-mainnet.g.alchemy.com/v2/YOUR_KEY
RPC_BSC=https://bsc-dataseed1.binance.org
RPC_BASE=https://base-mainnet.g.alchemy.com/v2/YOUR_KEY
RPC_ARB=https://arb-mainnet.g.alchemy.com/v2/YOUR_KEY
RPC_SOL=https://api.mainnet-beta.solana.com
# === On-Chain Signing (NEVER commit funded mainnet keys) ===
# Generate a fresh dedicated wallet: cast wallet new (EVM) | solana-keygen new (Solana)
# Use a SMALL-BALANCE ONLY wallet. NEVER use a primary/funded mainnet wallet here.
DEPLOYER_PRIVATE_KEY=
# ↑ Leave blank. Populate ONLY with a freshly generated, isolated dev/test wallet key.
SOL_PRIVATE_KEY=
# ↑ Leave blank. Base58 key — generate with: solana-keygen new --no-bip39-passphrase
# === Infrastructure ===
# NOTE: Trade_Tool backend services manage their own standalone configuration.
# Infrastructure secrets (DB, Redis, JWT) are completely isolated from this agent skill.
VAULT_TIMEOUT_MS=28800000
ENABLE_TESTNET=true
```
---
## XVIII. Pre-Install Security Checklist
Before activating this skill with live credentials, verify every item below:
| # | Check | Status |
| --- | ---------------------------------------------------------------------------------------------------------------------------------- | ------ |
| 1 | **Testnet first** — `ENABLE_TESTNET=true` tested successfully before mainnet | ☐ |
| 2 | **Dedicated wallets** — `DEPLOYER_PRIVATE_KEY` / `SOL_PRIVATE_KEY` are fresh wallets with minimal balance, not your primary wallet | ☐ |
| 3 | **Withdrawal disabled** — All CEX API keys (OKX / Binance / Gate / Bitget) have withdrawal permission explicitly OFF | ☐ |
| 4 | **IP whitelist enabled** — All exchange API keys locked to your server's IP address | ☐ |
| 5 | **Trade-only scope** — No Margin, Futures, or Cross-account permissions granted unless required | ☐ |
| 6 | **Secrets in .env only** — Credentials stored in `.env` (gitignored), never in source code or chat | ☐ |
| 7 | **Vault for mainnet** — Production keys stored in the project Vault system, not plain `.env` | ☐ |
| 8 | **Provenance verified** — Skill source confirmed at `https://github.com/StanPoldark/Trade_Tool` | ☐ |
| 9 | **Metadata in sync** — `requiredEnv` in YAML frontmatter matches §XVI table (verify: diff the `name:` fields in the YAML block against the §XVI Variable column, zero delta expected) | ☐ |
| 10 | **Small balance test** — First mainnet trade uses smallest viable amount to validate integration | ☐ |
> **How to use**: Copy this checklist into your project's `SECURITY.md` and confirm each item before
> going live. Skip any item only if that provider is not used in your deployment.
---
⚠️ This skill provides operational reference only and does not constitute investment advice. Always DYOR.
don't have the plugin yet? install it then click "run inline in claude" again.