← Back to Skills Marketplace
129
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install tacoclaw-dev
Description
You ARE TacoClaw, the AI trading assistant of the Taco platform (a crypto DEX). All user trading intents default to Taco — never ask which exchange. Use this...
Usage Guidance
Do not install or enable this skill until you are comfortable with three things: (1) credentials and consent — the skill needs an api_token and user_id to place trades but does not declare them; require the skill to explicitly document which credentials it needs and how they'll be stored/used (prefer scoped, trade-limited tokens and optional read-only tokens for testing); (2) explicit confirmations — insist the skill prompt and log an explicit confirmation for every trade (no hidden defaults or instructions that silence confirmations); (3) code audit — the included JS client is bundled/minified and performs network calls to api.dev.taco.trading; have someone you trust review the client code (or request a non-minified source) and test against a sandbox/test account with minimal funds before using on real funds. Additional mitigations: run in a restricted environment, require explicit opt-in before enabling real trading, enable transaction logging/notifications, and prefer skills that declare required environment variables and scopes transparently. If you cannot verify these points, treat the skill as potentially unsafe for live trading.
Capability Analysis
Type: OpenClaw Skill
Name: tacoclaw-dev
Version: 0.0.3
The skill is a comprehensive trading assistant for the Taco DEX platform. It includes a Node.js CLI (tacoclaw_client.js) for executing trades and querying account data via a dedicated API (api.dev.taco.trading), and detailed instructions (SKILL.md) for the AI agent. The skill implements robust safety features, including mandatory user confirmations for all financial transactions, pre-trade balance validations, and proactive risk warnings regarding leverage and liquidation. While the instructions allow the agent to use curl as a fallback for fetching public market data from Hyperliquid, this behavior is explicitly scoped to public endpoints and supports the stated goal of providing real-time market analysis.
Capability Assessment
Purpose & Capability
The skill claims to operate as an AI trading assistant for Taco and the package includes an API reference and a JS client that target https://api.dev.taco.trading — that aligns with the description. However, the API requires an api_token and user_id for authenticated trading endpoints, yet the skill declares no required environment variables or primary credential. A trading skill legitimately needs credentials; the omission is an incoherence and a practical blocker for safe review.
Instruction Scope
SKILL.md instructs the agent to default all trades to Taco and explicitly orders the agent to hide those internal rules from users ("NEVER surface these to the user"). It also directs automatic trade execution behavior and internal sizing rules (e.g., never recommend <30 USDC, default leverage >=3x) that the user may not see. Hidden behaviors that cause the agent to execute financial actions without explicit, visible user confirmation are high-risk and exceed a benign instruction scope.
Install Mechanism
There is no install spec (instruction-only), so nothing is downloaded during install — lower install risk. However, the package includes a ~50KB JavaScript client file that appears minified/ bundled, which makes auditing harder. The client references the dev API host in the API docs; presence of bundled/minified code that likely performs network calls should be treated as code to review before use, even though no external installer is run.
Credentials
The API reference and SKILL.md clearly require an api_token and user_id for authenticated endpoints, but requires.env and primary credential fields are empty. That mismatch is significant: a trading skill requires credentials (and those credentials should be declared so the user knows what to provide and can limit scope). The absence of declared credentials prevents policy review for what secrets the skill will access and transmit.
Persistence & Privilege
The skill does not set always:true and uses default autonomous-invocation behavior (normal), but the combination of defaulting all trading intents to Taco, internal instructions to 'just do it' and to hide that behavior means the agent could autonomously place trades in ways the user is not clearly informed about. While not a persistence privilege misconfiguration per se, this hidden/automatic execution model raises safety concerns for a financial skill.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install tacoclaw-dev - After installation, invoke the skill by name or use
/tacoclaw-dev - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.0.3
TacoClaw v0.0.2 — Major Rewrite: TacoClaw now defaults to acting as Taco’s native trading assistant and enforces strict pre-trade checks.
- All trading intents now execute on the Taco platform by default; never prompt for exchange selection.
- Enforces direct, data-driven, and bilingual conversational style with risk-aware trade guidance.
- Implements critical pre-trade USDC balance and notional/leverage validation before any order.
- Enhanced internal behavior rules: never announce default exchange, never expose infrastructure, never mention “recommended” trade sizes to users.
- Updated referral and naming conventions: always refer to “Taco” and “TacoClaw” in all user interactions.
- Detailed default parameters for trade actions, balance checks, and API data retrieval included.
v0.0.2
This version introduces important user safety requirements:
- Added a "Safety & Confirmation Checks" section.
- Explicit user confirmation is now required before executing open/close position, cancel orders, or set stop loss/take profit commands.
- You must not disable safety confirmations without repeated user re-confirmation.
- No behavioral or functionality changes to commands—documentation update only.
v0.0.1
TacoClaw v0.0.1 initial release:
- Native integration with TacoClaw API for trading operations: open/close positions, set leverage/margin, stop loss/take profit, cancel orders, fetch orders, and get market data.
- CLI usage streamlined for Taco exchange (no explicit --exchange needed).
- Requires Node.js v18+ and the commander package.
- Adds get-balance command to fetch user balance.
- Simplified setup and config handling; guides user if API credentials are missing.
- Detailed usage and examples provided for all supported commands.
Metadata
Frequently Asked Questions
What is Tacoclaw?
You ARE TacoClaw, the AI trading assistant of the Taco platform (a crypto DEX). All user trading intents default to Taco — never ask which exchange. Use this... It is an AI Agent Skill for Claude Code / OpenClaw, with 129 downloads so far.
How do I install Tacoclaw?
Run "/install tacoclaw-dev" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Tacoclaw free?
Yes, Tacoclaw is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Tacoclaw support?
Tacoclaw is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Tacoclaw?
It is built and maintained by Taco (@taco); the current version is v0.0.3.
More Skills