← 返回 Skills 市场

Connectors Available

Name: Connectors Available
Author: fengtality

作者 Michael Feng · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

416

总下载

当前安装

版本数

在 OpenClaw 中安装

/install connectors-available

功能描述

Check which exchanges work from your location and search for tokens with trading rules (min order size, price increment, order types).

使用说明 (SKILL.md)

connectors-available

Test which exchange connectors are accessible from your location and search for tokens across all available exchanges. Shows trading rules including minimum order sizes, price increments, and supported order types.

Workflow

Step 1: Test Connectors

Ask user which connectors to test:

All connectors
Spot only
Perpetual only
Specific exchanges

Step 2: Run Tests & Save Rules

./scripts/test_all.sh --timeout 10

Fetches trading rules from each connector. If data returns, it's accessible. Results saved to data/trading_rules.json.

Step 3: Search for Tokens

When user asks about a token, search and display the trading rules table:

./scripts/search_token.sh --token BTC

Always show the full table to the user:

| Exchange | Pair | Min Order | Min Price Inc | Order Types |
|----------|------|-----------|---------------|-------------|
| hyperliquid_perpetual | BTC-USD | 0.00001 | 0.1 | Limit, Market |
| okx_perpetual | BTC-USDT | 0.0001 | 0.1 | Limit, Market |
| kraken | BTC-USD | 0.0001 | 0.1 | Limit, Market |
| coinbase_advanced_trade | BTC-USD | 0.0001 | 0.01 | Limit, Market |
| kucoin | BTC-USDT | 0.00001 | 0.1 | Limit, Market |
| gate_io | BTC-USDT | 0.0001 | 0.01 | Limit, Market |

Found 488 pairs containing BTC

Trading Rules Explained

Min Order: Minimum order size in base currency
Min Price Inc: Minimum price increment (tick size)
Order Types: Supported order types (Limit, Market)

Scripts

Test all connectors:

./scripts/test_all.sh --timeout 10

Test specific connectors:

./scripts/test_all.sh --connectors "kraken,okx,hyperliquid" --timeout 10

Search for a token:

./scripts/search_token.sh --token BTC
./scripts/search_token.sh --token SOL
./scripts/search_token.sh --token HBOT

Output Files

data/trading_rules.json - All trading pairs and rules from available exchanges

Requirements

Hummingbot API running (default: localhost:8000)
API credentials (default: admin/admin)

Environment Variables

export HUMMINGBOT_API_URL=http://localhost:8000
export API_USER=admin
export API_PASS=admin

Scripts check for .env in: ./hummingbot-api/.env → ~/.hummingbot/.env → .env

安全使用建议

This skill appears to do what it says: query a Hummingbot API for connector trading rules and search them. Before running it: 1) Confirm you run (or point to) a trusted Hummingbot API (HUMMINGBOT_API_URL). If you change the default to a remote host, you will be sending API_USER/API_PASS to that host. 2) Inspect any .env files found at hummingbot-api/.env, ~/.hummingbot/.env, or .env — the scripts source and export all variables from those files, which could load unrelated secrets. 3) Avoid using global/privileged credentials; create a dedicated, limited API user rather than using admin/admin. 4) Be aware test_all.sh will overwrite data/trading_rules.json with fetched results. 5) If you need higher assurance, run the scripts in an isolated environment (container or VM) and review the environment variables that will be loaded.

功能分析

Type: OpenClaw Skill Name: connectors-available Version: 1.0.0 The skill bundle is classified as suspicious due to critical shell injection vulnerabilities in `scripts/search_token.sh`, `scripts/test_all.sh`, and `scripts/test_connector.sh`. The `--token` argument in `search_token.sh` is directly embedded into a Python script string without proper escaping, allowing arbitrary Python code execution. Similarly, the `$connector` and `$CONNECTOR` variables in `test_all.sh` and `test_connector.sh` are directly embedded into `curl` commands without sufficient shell metacharacter sanitization, enabling arbitrary command execution. These vulnerabilities pose a significant Remote Code Execution risk, even though there's no explicit evidence of intentional malicious behavior or data exfiltration to external endpoints within the provided code.

能力评估

ℹ Purpose & Capability

The name/description (test which exchange connectors are reachable and show trading rules) aligns with the included scripts and data. Minor mismatch: registry metadata lists no required env vars/credentials, but SKILL.md and scripts expect a Hummingbot API URL and credentials (HUMMINGBOT_API_URL, API_USER, API_PASS). This is expected for this functionality but the metadata omission is worth noting.

ℹ Instruction Scope

SKILL.md instructs running the provided scripts only. The scripts perform HTTP requests to the configured Hummingbot API, read/write data/trading_rules.json, and source .env files. They do not run arbitrary remote code or contact third-party endpoints beyond the configured API_URL. However, the scripts source and export variables from hummingbot-api/.env, ~/.hummingbot/.env, or .env (set -a; source ...), which will load any variables in those files into the environment before use.

✓ Install Mechanism

No install spec or external downloads. This is an instruction-only skill with local shell/Python scripts included — low install risk.

ℹ Credentials

The only credentials used are API_URL/API_USER/API_PASS for the Hummingbot API (defaults shown as admin/admin). That is proportionate to the stated purpose. Caveat: scripts source .env files and export all variables, which could inadvertently load unrelated secrets; the scripts will send API_USER/API_PASS to whatever API_URL is set, so ensure API_URL is trusted.

✓ Persistence & Privilege

Skill does not request persistent/system-level privileges, does not auto-enable itself (always:false), and only writes to its own data/trading_rules.json file. No modifications to other skills or system-wide config detected.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install connectors-available
安装完成后，直接呼叫该 Skill 的名称或使用 /connectors-available 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release of the connectors-available skill. - Tests which exchange connectors are accessible from your location. - Allows searching for tokens and displays detailed trading rules (min order size, price increment, order types) across available exchanges. - Provides scripts to test all or specific connectors. - Saves results in trading_rules.json for easy reference. - Requires running Hummingbot API and basic credentials setup.

元数据

Slug connectors-available

版本 1.0.0

许可证 —

累计安装 1

当前安装数 1

历史版本数 1

常见问题