← 返回 Skills 市场

CoinAPI OpenAPI Skill

Name: CoinAPI OpenAPI Skill
Author: jolestar

作者 jolestar · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ⚠ suspicious

212

总下载

当前安装

版本数

在 OpenClaw 中安装

/install coinapi-openapi-skill

功能描述

Operate CoinAPI market data reads through UXC with a curated OpenAPI schema, API-key auth, and read-first guardrails.

使用说明 (SKILL.md)

CoinAPI REST Skill

Use this skill to run CoinAPI REST market data operations through uxc + OpenAPI.

Reuse the uxc skill for shared execution, auth, and error-handling guidance.

Prerequisites

uxc is installed and available in PATH.
Network access to https://rest.coinapi.io.
Access to the curated OpenAPI schema URL:
- https://raw.githubusercontent.com/holon-run/uxc/main/skills/coinapi-openapi-skill/references/coinapi-market.openapi.json
A CoinAPI key.

Scope

This skill covers a read-first market data surface:

current exchange rates
current quote snapshots
latest OHLCV candles
latest trades
latest order books

This skill does not cover:

FIX, WebSocket, or MCP transport surfaces
write operations
the broader CoinAPI catalog

Authentication

CoinAPI uses X-CoinAPI-Key header auth.

Configure one API-key credential and bind it to rest.coinapi.io:

uxc auth credential set coinapi \
  --auth-type api_key \
  --api-key-header X-CoinAPI-Key \
  --secret-env COINAPI_KEY

uxc auth binding add \
  --id coinapi \
  --host rest.coinapi.io \
  --scheme https \
  --credential coinapi \
  --priority 100

Validate the active mapping when auth looks wrong:

uxc auth binding match https://rest.coinapi.io

Core Workflow

Use the fixed link command by default:
- command -v coinapi-openapi-cli
- If missing, create it: uxc link coinapi-openapi-cli https://rest.coinapi.io --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/coinapi-openapi-skill/references/coinapi-market.openapi.json
- coinapi-openapi-cli -h
Inspect operation schema first:
- coinapi-openapi-cli get:/v1/exchangerate/{asset_id_base}/{asset_id_quote} -h
- coinapi-openapi-cli get:/v1/ohlcv/{symbol_id}/latest -h
- coinapi-openapi-cli get:/v1/trades/{symbol_id}/latest -h
Prefer narrow spot and latest reads before broader crawls:
- coinapi-openapi-cli get:/v1/exchangerate/{asset_id_base}/{asset_id_quote} asset_id_base=BTC asset_id_quote=USD
- coinapi-openapi-cli get:/v1/quotes/current filter_symbol_id=BINANCE_SPOT_BTC_USDT
Execute with key/value parameters:
- coinapi-openapi-cli get:/v1/ohlcv/{symbol_id}/latest symbol_id=BINANCE_SPOT_BTC_USDT period_id=1DAY limit=10
- coinapi-openapi-cli get:/v1/orderbooks/{symbol_id}/latest symbol_id=BINANCE_SPOT_BTC_USDT limit_levels=20

Operations

get:/v1/exchangerate/{asset_id_base}/{asset_id_quote}
get:/v1/quotes/current
get:/v1/ohlcv/{symbol_id}/latest
get:/v1/trades/{symbol_id}/latest
get:/v1/orderbooks/{symbol_id}/latest

Guardrails

Keep automation on the JSON output envelope; do not use --text.
Parse stable fields first: ok, kind, protocol, data, error.
Treat this v1 skill as read-only. Do not imply order entry or market connectivity support.
Keep filter_symbol_id, period_id, limit, and limit_levels narrow unless the user explicitly wants larger pulls.
coinapi-openapi-cli \x3Coperation> ... is equivalent to uxc https://rest.coinapi.io --schema-url \x3Ccoinapi_openapi_schema> \x3Coperation> ....

References

Usage patterns: references/usage-patterns.md
Curated OpenAPI schema: references/coinapi-market.openapi.json
CoinAPI REST docs: https://docs.coinapi.io/market-data/rest-api

安全使用建议

This skill appears to be a coherent, read-only CoinAPI integration, but there are two gaps you should resolve before installing or using it: (1) SKILL.md requires a CoinAPI API key (COINAPI_KEY) and UXC to be installed, but the registry metadata does not declare that secret or those binaries — confirm how and where you'll supply the COINAPI_KEY (use a least-privileged/read-only key) and ensure uxc is installed from a trusted source; (2) the included validation script requires jq and ripgrep (rg) which are not declared — these are only for local validation but be aware if you run the script. Also verify the curated OpenAPI schema URL (raw.githubusercontent.com/holon-run/...) is from a source you trust. If the publisher cannot explain why the manifest omits the COINAPI_KEY requirement, treat the omission as a red flag and avoid providing secrets until clarified.

功能分析

Type: OpenClaw Skill Name: coinapi-openapi-skill Version: 1.0.0 The skill is a legitimate integration for accessing CoinAPI market data using the `uxc` CLI tool. It defines read-only operations (exchange rates, quotes, OHLCV) via a curated OpenAPI schema and provides clear instructions for secure API key management using environment variables. The included validation script (`scripts/validate.sh`) and documentation (`SKILL.md`, `usage-patterns.md`) are consistent with the stated purpose and do not contain any indicators of malicious intent or data exfiltration.

能力评估

ℹ Purpose & Capability

The name, description, OpenAPI schema, and runtime instructions all consistently describe a read-only CoinAPI market-data skill using UXC and an OpenAPI schema. That purpose matches the included files (schema, usage patterns, guardrails). However, the skill's manifest metadata declares no primary credential or required env vars while the SKILL.md explicitly requires a CoinAPI API key (COINAPI_KEY) and UXC auth binding; this discrepancy is unexpected and should be justified.

✓ Instruction Scope

SKILL.md stays within the stated read-only scope: it documents only GET operations, instructs use of uxc and a linked CLI, and contains guardrails about read-only behavior and narrow queries. It does not ask the agent to read unrelated local files or exfiltrate data. The only scope creep is the implicit assumption that the runtime environment will provide UXC and the COINAPI_KEY secret (neither declared in the registry metadata).

ℹ Install Mechanism

This is instruction-only (no install spec), which is lower risk. Included script scripts/validate.sh performs local checks and requires jq and rg (ripgrep) — these are development/validation dependencies but were not declared in the manifest's required binaries. The script does not download or execute remote code and appears to only validate file presence and schema shape.

⚠ Credentials

SKILL.md requires a CoinAPI API key bound to rest.coinapi.io and instructs using the COINAPI_KEY secret env var, but the skill metadata lists no required env vars and no primary credential. That mismatch is the main proportionality concern: the skill needs a sensitive secret to function but does not declare it. Additionally, the validate script expects jq and rg but these binaries are not declared either. Requiring a single CoinAPI API key for read-only market data is proportionate — but it should be declared in the manifest and the consumer should know exactly where/how to supply it.

✓ Persistence & Privilege

The skill does not request always:true and does not modify other skills. There is no install spec that writes persistent binaries, and SKILL.md only instructs creating a uxc CLI link (uxc link) which is scoped to uxc tooling. Autonomous invocation is allowed (default) but that is normal; it is not combined with other high-risk privileges.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install coinapi-openapi-skill
安装完成后，直接呼叫该 Skill 的名称或使用 /coinapi-openapi-skill 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

- Initial release of coinapi-openapi-skill. - Enables secure, read-only CoinAPI market data access via UXC with OpenAPI schema. - Supports key endpoints: exchange rates, quotes, OHLCV, trades, and order books. - Includes API-key authentication setup and usage guardrails. - Provides step-by-step workflow and CLI integration instructions.

元数据

Slug coinapi-openapi-skill

版本 1.0.0

许可证 MIT-0

累计安装 1

当前安装数 1

历史版本数 1

常见问题