← 返回 Skills 市场

APEX Binary Trader

Name: APEX Binary Trader
Author: leejoe411-creator

作者 leejoe411-creator · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ⚠ suspicious

279

总下载

当前安装

版本数

在 OpenClaw 中安装

/install apex

功能描述

Intelligent agent trading Kalshi 15-min binary crypto markets by analyzing RSI, momentum, volume, and AI signals to place limit orders on BTC, ETH, SOL, XRP.

使用说明 (SKILL.md)

APEX — Binary Trading Agent

What I do

APEX is an intelligent binary options trading agent for Kalshi 15-minute crypto markets. I scan BTC, ETH, SOL, and XRP markets every 15 minutes, analyze signals, consult AI, and place trades.

Commands

Command	Description
`python3 {baseDir}/scripts/apex.py`	Run one full scan + trade cycle
`python3 {baseDir}/scripts/apex.py --status`	Show balance, P&L, open positions
`python3 {baseDir}/scripts/apex.py --log`	Show recent trade log

How APEX trades

Scans Kalshi 15-min binary markets (KXBTC15M, KXETH15M, KXSOL15M, KXXRP15M)
Pulls RSI, momentum, volume from Coinbase
Votes on direction (UP/DOWN) — needs 3/4 signals aligned
GPT-4o-mini confirms trade, picks YES/NO, sizes position
Places limit order on Kalshi
Judges results when markets resolve

Environment Variables

KALSHI_API_KEY_ID — Kalshi API key UUID
KALSHI_PRIVATE_KEY_PATH — Path to RSA private key PEM
OPENAI_API_KEY — OpenAI API key
TELEGRAM_BOT_TOKEN — Telegram bot token
TELEGRAM_CHAT_ID — Telegram chat ID

Market knowledge

15-min markets open at :00, :15, :30, :45 every hour
Markets resolve based on CF Benchmarks BRTI price
YES = price higher at expiry, NO = price lower
Best entry window: 8-14 minutes before expiry
Avoid trading when RSI is 45-55 (choppy/unclear)

安全使用建议

Do not run this skill unmodified. The script contains hardcoded API keys, a hardcoded RSA private-key path and Telegram token/chat, and writes to absolute /Users/kao paths — even though the SKILL.md/_meta claim it will use environment variables. This mismatch can cause the skill to (a) use the developer's OpenAI/Telegram/Kalshi credentials (incurring charges and leaking data), (b) read a local private key if it exists at the hardcoded path, or (c) fail unexpectedly. Before installing or running: (1) inspect the full scripts locally; (2) remove any hardcoded secrets and replace them with well-documented environment-variable usage; (3) change absolute paths to configurable relative paths; (4) run in an isolated sandbox or staging account (no real funds); and (5) prefer a version that reads credentials from environment or a secure store and documents required Python dependencies. If you cannot verify the origin of the hardcoded keys, treat this package as untrusted.

功能分析

Type: OpenClaw Skill Name: apex Version: 1.0.0 The script `scripts/apex.py` contains several hardcoded sensitive credentials, including an OpenAI API key and a Telegram Bot token (7956217548:AAEV9...). It is configured to exfiltrate the user's trading activity, account balances, and P&L data to a hardcoded Telegram Chat ID (6850287860), which constitutes a significant data leak. Additionally, the script ignores the environment variables specified in `SKILL.md` in favor of hardcoded local file paths (e.g., `/Users/kao/...`), indicating the skill was poorly sanitized and poses a high risk of unauthorized data disclosure.

能力评估

⚠ Purpose & Capability

The skill's stated purpose (autonomous Kalshi trading) matches the code's functionality, but metadata and SKILL.md declare environment variables for keys while the script ignores them and uses hardcoded KEY_ID, KEY_PATH, OPENAI_KEY, TG_TOKEN, TG_CHAT and absolute filesystem paths. That mismatch is not proportionate or expected.

⚠ Instruction Scope

SKILL.md tells the agent to run the Python script and lists env vars, but the runtime code doesn't read those env vars and instead will load a private key from an absolute path, post to Telegram via a hardcoded token, call OpenAI with a hardcoded API key, and read/write state/log files at absolute /Users/kao paths. The instructions therefore understate what the code will do and grant the skill broader access than described.

ℹ Install Mechanism

No install spec (instruction-only + included script) — lowest install risk. However the script imports third-party Python packages (requests, numpy, cryptography) that are not declared in metadata; missing dependency declarations may cause runtime surprises but are not inherently malicious.

⚠ Credentials

SKILL.md/_meta request Kalshi/OpenAI private key envs which would be proportionate, but the script instead hardcodes multiple sensitive values (Kalshi key id and private key path, an OpenAI API key literal, Telegram token/chat id). Hardcoded secrets can (1) use the author's accounts to make API calls and incur costs, (2) leak information to those accounts, and (3) unintentionally access local files because of absolute paths — all disproportionate to a clean skill install.

ℹ Persistence & Privilege

The skill is not always:true and does not modify other skills, which is good. But it writes state/log to absolute paths under /Users/kao and reads a private key from an absolute path — non-portable and potentially able to access files on disk if those paths exist. This elevates risk if run on a system containing those paths/keys.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install apex
安装完成后，直接呼叫该 Skill 的名称或使用 /apex 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

APEX 1.0.0 - Initial Release - Launches as a binary options trading agent for Kalshi 15-minute crypto markets. - Monitors BTC, ETH, SOL, and XRP markets every 15 minutes and places trades based on technical signals and AI confirmation. - Provides status, trade log, and manual scan/trade commands via CLI scripts. - Integrates with Coinbase for market data, and uses GPT-4o-mini for trade decisions and sizing. - Supports Telegram notifications and requires configurable API credentials via environment variables.

元数据

Slug apex

版本 1.0.0

许可证 MIT-0

累计安装 1

当前安装数 1

历史版本数 1

常见问题