← 返回 Skills 市场

Binance Exchange

Name: Binance Exchange
Author: torchesfrms

作者 moer · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ⚠ suspicious

139

总下载

当前安装

版本数

在 OpenClaw 中安装

/install binance-exchange

功能描述

Fetch real-time prices, 24h stats, K-line charts, and market info for Binance spot trading pairs using the Binance API via proxy.

使用说明 (SKILL.md)

Binance Exchange Skill

Query Binance spot exchange data via API. Requires proxy for network access.

Prerequisites

Proxy Configuration:

# Uses system proxy
export HTTP_PROXY="http://127.0.0.1:1082"
export HTTPS_PROXY="http://127.0.0.1:1082"

Note: Binance API may be restricted in certain regions. Use a proxy node in allowed regions (HK/SG/JP/UK/DE).

API Endpoints

Endpoint	Use Case
`/api/v3/ticker/price`	Real-time prices
`/api/v3/ticker/24hr`	24h statistics
`/api/v3/klines`	K-line/candlestick data
`/api/v3/exchangeInfo`	Trading rules & symbols

Scripts

1. Price Query

# Single symbol
./scripts/price.sh BTCUSDT

# Multiple symbols
./scripts/price.sh BTCUSDT ETHUSDT BNBUSDT

2. 24h Change (via K-lines)

# Single symbol
./scripts/change.sh BTCUSDT

# Top gainers (requires custom processing)
./scripts/gainers.sh

3. K-Line Data

# BTC 1hour K-line (100 candles)
./scripts/kline.sh BTCUSDT 1h 100

# ETH 4hour K-line
./scripts/kline.sh ETHUSDT 4h 50

4. Token Info (New!)

# Get basic price
./scripts/token-info.sh BTCUSDT

# Get 24h statistics
./scripts/token-info.sh BTCUSDT stats

Returns:

Symbol, price, 24h change, change %, 24h high/low, volume, quote volume

5. Search Symbols

# Search USDT pairs
./scripts/search.sh USDT

Quick Reference

Data	Command
BTC price	`./scripts/price.sh BTCUSDT`
24h stats	`./scripts/token-info.sh BTCUSDT stats`
K-line	`./scripts/kline.sh BTCUSDT 1h 100`

Rate Limits

1200 requests/minute (public endpoints)
Use caching for frequent queries

安全使用建议

This skill appears to do what it says (query Binance public endpoints) but I recommend the following before using or installing it: 1) Verify dependencies: install and trust curl, jq, and bc — the scripts need them but the metadata doesn't declare them. 2) Check the missing script: SKILL.md references scripts/search.sh which isn't included; ask the author or remove references. 3) Resolve proxy inconsistencies: decide whether a proxy is required; if you must use a proxy, only use one you trust (running a local proxy can route traffic through third parties). 4) Review scripts locally before execution — they make outbound HTTPS requests to api.binance.com and do not exfiltrate other data, but always run untrusted scripts in an isolated environment. 5) If you need stronger assurance, request an updated package from the author that declares dependencies and fixes the documentation mismatches.

功能分析

Type: OpenClaw Skill Name: binance-exchange Version: 1.0.0 The skill bundle contains multiple shell scripts (change.sh, kline.sh, price.sh, and token-info.sh) that are vulnerable to shell command injection. User-provided arguments such as 'SYMBOL' are expanded within double-quoted strings or passed to jq filters without proper sanitization, allowing for potential arbitrary command execution (e.g., via $(command) syntax) if the AI agent passes unsanitized user input. While the scripts appear intended for legitimate Binance API queries, the lack of input validation constitutes a significant security flaw.

能力评估

ℹ Purpose & Capability

The scripts implement public Binance REST queries (prices, klines, 24h stats) which matches the skill description. However, the skill metadata declares no required binaries while the scripts clearly require curl, jq and bc (and rely on a proxy). Declaring those binaries would be expected for this purpose.

⚠ Instruction Scope

SKILL.md and the scripts instruct network calls to https://api.binance.com only (expected). Concerns: SKILL.md references ./scripts/search.sh in examples but no search.sh file is present; token-info.sh claims "no proxy needed" while SKILL.md states a proxy is required and other scripts hard-code a local proxy (-x http://127.0.0.1:1082). These inconsistencies could cause surprising failures or indicate sloppy packaging.

✓ Install Mechanism

No install spec and no remote downloads — the skill is instruction + local scripts only. No extracted archives or off-site install URLs were found, which is low risk from an installation perspective.

ℹ Credentials

No credentials or secret environment variables are requested (good). The skill asks users to set HTTP_PROXY/HTTPS_PROXY to a local proxy; that is plausible for region-restricted API access but requires the user to provide/trust the proxy. token-info.sh reads HTTP_PROXY optionally but does not consistently use it.

✓ Persistence & Privilege

The skill does not request persistent presence, does not alter other skills, and does not claim elevated privileges. always is false and there is no install step that modifies system or agent configuration.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install binance-exchange
安装完成后，直接呼叫该 Skill 的名称或使用 /binance-exchange 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

- Initial release of the Binance Exchange skill. - Query real-time spot prices, 24-hour changes, K-line charts, and market info from Binance via API. - Includes scripts for price, K-line data, token info, and symbol search. - Requires HTTP proxy setup (http://127.0.0.1:1082) for network access. - Provides API usage instructions, example commands, and rate limit notes.

元数据

Slug binance-exchange

版本 1.0.0

许可证 MIT-0

累计安装 1

当前安装数 1

历史版本数 1

常见问题