功能描述

Agent skill that faithfully reproduces Hummingbot CLI commands (connect, balance, create, start, stop, status, history) via Hummingbot API. V1 focuses on cor...

使用说明 (SKILL.md)

hummingbot

Name: Hummingbot
Author: fengtality

When the skill is loaded, print this ASCII art:

                                      *,.
                                    *,,.*
                                   ,,,,    .,*
                                 *,,,,,,,(       .,,
                               *,,,,,,,,         .,,,                      *
                              /,,,,,,,,,,    .*,,,,,,,
                                 .,,,,,,,,,,,   .,,,,,,,,,,*

                    //                ,,,,,,,,,,,,,,,,,,,,,,,,,,#*%
                 .,,,,,,,. *,,,,,,,,,,,,,,,,,,,,,,,,,,,,,%%%%&@
                      ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,%%%%%%%&
                          ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,%%%%%%%%&
                    /*,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,((%%%&
              .**       #,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,((((((((#.
           **             *,,,,,,,,,,,,,,,,,,,,,,**/(((((((((((*
                           ,,,,,,,,,,,,,,,,,,,*******((((((((((
                            (,,,,,,,,,,,************((((((((@
                              *,,,,,,,,,,****************(#
                               ,,,,,,,,,,,***************/
                                ,,,,,,,,,,,***************/
                                 ,,,,,,,,,,****************
                                  .,,,,,,,,***************'/
                                     ,,,,,,*******,
                                     *,,,,,,********
                                      ,,,,,,,,/******/
                                       ,,,,,,,,@   /****/
                                        ,,,,,,,,
                                          , */

 ██╗  ██╗██╗   ██╗███╗   ███╗███╗   ███╗██╗███╗   ██╗ ██████╗ ██████╗  ██████╗ ████████╗
 ██║  ██║██║   ██║████╗ ████║████╗ ████║██║████╗  ██║██╔════╝ ██╔══██╗██╔═══██╗╚══██╔══╝
 ███████║██║   ██║██╔████╔██║██╔████╔██║██║██╔██╗ ██║██║  ███╗██████╔╝██║   ██║   ██║
 ██╔══██║██║   ██║██║╚██╔╝██║██║╚██╔╝██║██║██║╚██╗██║██║   ██║██╔══██╗██║   ██║   ██║
 ██║  ██║╚██████╔╝██║ ╚═╝ ██║██║ ╚═╝ ██║██║██║ ╚████║╚██████╔╝██████╔╝╚██████╔╝   ██║
 ╚═╝  ╚═╝ ╚═════╝ ╚═╝     ╚═╝╚═╝     ╚═╝╚═╝╚═╝  ╚═══╝ ╚═════╝ ╚═════╝  ╚═════╝    ╚═╝

This skill faithfully reproduces Hummingbot CLI commands via Hummingbot API, bringing the same trading workflows you know from Hummingbot to AI agents.

Note: Hummingbot API supports V2 strategies only (V2 Controllers and V2 Scripts). V1 strategies are not supported and require the traditional Hummingbot client.

Commands

Command	Description
`connect`	List available exchanges and add API keys
`balance`	Display asset balances across connected exchanges
`create`	Create a new bot configuration
`start`	Start a bot with a V2 strategy
`stop`	Stop a running bot
`status`	Display bot status
`history`	Display bot trading history

Prerequisites

Hummingbot API running at http://localhost:8000 (deploy with /hummingbot-deploy)
hummingbot-api-client installed: pip3 install hummingbot-api-client

Auth & Config

Scripts read credentials from these sources in order:

./hummingbot-api/.env — created during make setup
~/.hummingbot/.env
Environment variables: HUMMINGBOT_API_URL, API_USER, API_PASS
Defaults: http://localhost:8000, admin, admin

connect

List available exchanges and add API keys to them.

# List all available connectors
python scripts/connect.py

# List connectors with connection status
python scripts/connect.py --status

# Add API keys for an exchange
python scripts/connect.py binance --api-key YOUR_KEY --secret-key YOUR_SECRET

# Add API keys for exchange requiring passphrase
python scripts/connect.py kucoin --api-key YOUR_KEY --secret-key YOUR_SECRET --passphrase YOUR_PASS

# Remove credentials for an exchange
python scripts/connect.py binance --remove

Common credential fields by exchange:

Binance: --api-key, --secret-key
KuCoin: --api-key, --secret-key, --passphrase
Gate.io: --api-key, --secret-key
OKX: --api-key, --secret-key, --passphrase

balance

Display your asset balances across all connected exchanges.

# Show all balances
python scripts/balance.py

# Show balances for a specific connector
python scripts/balance.py binance

# Show balances in USD
python scripts/balance.py --usd

# Show only non-zero balances
python scripts/balance.py --non-zero

Output columns:

Exchange/Connector name
Asset symbol
Total balance
Available balance
USD value (with --usd)

create

Create a new bot configuration (controller config or script config).

# List available controller templates
python scripts/create.py --list-controllers

# List available scripts
python scripts/create.py --list-scripts

# List existing configs
python scripts/create.py --list-configs

# Create a controller config
python scripts/create.py controller my_mm_config --template pmm_v1

Recommended Market Making Controllers

Controller	Best For	Key Features
pmm_v1	CEX spot trading	Multi-level spreads, inventory skew, order refresh, price bands
pmm_mister	Spot & perpetuals	Position tracking, leverage, cooldowns, profit protection, hanging executors

pmm_v1: Faithful clone of the legacy Pure Market Making strategy. Configure buy_spreads, sell_spreads, order_amount, and enable inventory_skew to maintain balance.

pmm_mister: Advanced controller for spot and perpetual markets with leverage, take_profit, global_stop_loss, separate buy_cooldown_time/sell_cooldown_time, and position_profit_protection to prevent selling below breakeven.

start

Start a bot with a V2 strategy configuration. V1 strategies are not supported.

# Interactive mode - prompts for strategy type
python scripts/start.py \x3Cbot_name>

# Start with a V2 Controller config
python scripts/start.py \x3Cbot_name> --controller \x3Cconfig_name>

# Start with a V2 Script
python scripts/start.py \x3Cbot_name> --script \x3Cscript_name>

# Start with a V2 Script and config file
python scripts/start.py \x3Cbot_name> --script \x3Cscript_name> --config \x3Cconfig_name>

# List running bots
python scripts/start.py --list

V2 Strategy Types:

--controller — Deploy a V2 controller config (market making, arbitrage, etc.)
--script — Deploy a V2 script (e.g., v2_with_controllers)

Bot naming: Use descriptive names like btc_mm_bot, eth_arb_bot, etc.

stop

Stop a running bot.

# Stop a bot by name
python scripts/stop.py \x3Cbot_name>

# Stop a bot and close all positions
python scripts/stop.py \x3Cbot_name> --close-positions

# Stop all running bots
python scripts/stop.py --all

# Examples
python scripts/stop.py my_bot
python scripts/stop.py arb_bot --close-positions

status

Display bot status and performance metrics.

# List all bots with status
python scripts/status.py

# Get detailed status for a specific bot
python scripts/status.py \x3Cbot_name>

# Get status with performance metrics
python scripts/status.py \x3Cbot_name> --performance

# Get live status (refreshes)
python scripts/status.py \x3Cbot_name> --live

Status values: running, stopped, error, starting

Performance metrics:

Total trades
Profit/Loss (absolute and %)
Volume traded
Uptime

history

Display bot trading history.

# Show trade history for a bot
python scripts/history.py \x3Cbot_name>

# Show summary statistics
python scripts/history.py \x3Cbot_name> --summary

History columns:

Timestamp
Trading pair
Side (buy/sell)
Price
Amount
Fee
PnL

Quick Reference

Typical Workflow

# 1. Connect to an exchange
python scripts/connect.py binance --api-key XXX --secret-key YYY

# 2. Check your balances
python scripts/balance.py binance

# 3. Create a bot config
python scripts/create.py controller btc_mm \
  --template pure_market_making \
  --connector binance \
  --trading-pair BTC-USDT

# 4. Start the bot
python scripts/start.py btc_bot --controller btc_mm

# 5. Monitor status
python scripts/status.py btc_bot

# 6. Check history
python scripts/history.py btc_bot

# 7. Stop when done
python scripts/stop.py btc_bot

Troubleshooting

Error	Cause	Fix
`Cannot connect to API`	API not running	`cd ./hummingbot-api && make deploy`
`401 Unauthorized`	Bad credentials	Check `./hummingbot-api/.env`
`Connector not found`	Invalid exchange name	Run `python scripts/connect.py` to list valid names
`No credentials`	Exchange not connected	Run `python scripts/connect.py \x3Cexchange> --api-key ...`

Related Skills

lp-agent — Specialized DEX liquidity provision on Meteora/Solana. Use for CLMM strategies.
hummingbot-deploy — First-time setup of the Hummingbot API server. Run this before using this skill.

安全使用建议

This package appears to be a legitimate adapter for controlling a Hummingbot API instance from an AI agent. Before installing or using it: (1) ensure your Hummingbot API endpoint is local and not exposed to the public internet; the default credentials are admin/admin so change them if the API is reachable; (2) understand that the scripts will read .env files and prompt for exchange API keys and then store those keys via the Hummingbot API — only provide exchange credentials if you trust the Hummingbot backend and its storage; (3) note the registry metadata does not declare the HUMMINGBOT_API_URL/API_USER/API_PASS env vars even though the code uses them — consider setting explicit environment variables or reviewing the .env files the client will load; (4) review or run the code in a sandbox if you want to verify behavior, and ensure you have network isolation if you are concerned about credential leakage.

功能分析

Type: OpenClaw Skill Name: hummingbot Version: 1.0.1 The skill is designed to interact with a local Hummingbot API, and most scripts use the provided `hummingbot-api-client` correctly. However, `scripts/history.py` deviates from this pattern by implementing its own API request logic using `urllib.request`. This script constructs the request URL by directly concatenating user-controlled input (`bot_name`) into the endpoint, creating a Server-Side Request Forgery (SSRF) vulnerability. An attacker capable of controlling the `bot_name` argument (e.g., via prompt injection against the agent) could exploit this to make arbitrary requests to local network services or potentially external ones if the `HUMMINGBOT_API_URL` environment variable is configured to a non-localhost address. This is a significant vulnerability, classifying the skill as suspicious rather than malicious due to the lack of clear evidence of intentional self-exploitation within the provided code.

能力评估

ℹ Purpose & Capability

Name/description match the provided scripts: the bundle implements CLI-like commands (connect, balance, create, start, stop, status, history) using a Hummingbot API client. The code imports hummingbot_api_client and expects a local API endpoint, which is proportionate. Minor mismatch: registry metadata lists no required environment variables, but SKILL.md and code rely on HUMMINGBOT_API_URL, API_USER, API_PASS and several .env file locations.

ℹ Instruction Scope

SKILL.md and the scripts confine actions to managing bots, connectors, balances, market data and history via the Hummingbot API. The scripts explicitly read .env files (./hummingbot-api/.env, ~/.hummingbot/.env, .env) and environment variables for API URL/credentials, prompt for exchange API keys, and send/store credentials to the Hummingbot API — all expected for this purpose but also sensitive operations you should be aware of.

✓ Install Mechanism

No install spec in registry; SKILL.md only recommends pip installing 'hummingbot-api-client'. There are no downloads from arbitrary URLs or archive extraction in the manifest, so install risk is minimal and expected.

ℹ Credentials

The code legitimately needs access to Hummingbot API credentials and to accept exchange API keys. However, the registry declares no required env vars despite SKILL.md/code using HUMMINGBOT_API_URL, API_USER, API_PASS and reading .env files. The scripts will prompt for and send exchange API secrets to the Hummingbot API backend — this is expected but sensitive and worth verifying.

✓ Persistence & Privilege

The skill is not marked 'always: true' and is user-invocable; it does not modify other skills or system-wide settings. It uses the Hummingbot API to store credentials/configs rather than writing to global agent configuration.

版本历史

v1.0.1

Sync from hummingbot/skills a9089c3

v1.0.0

Initial release — core skill for managing bots, strategies, connectors, and accounts via Hummingbot API

元数据

Slug hummingbot

版本 1.0.1

许可证 —

累计安装 1

当前安装数 1

历史版本数 2

常见问题

Hummingbot 是什么？

Agent skill that faithfully reproduces Hummingbot CLI commands (connect, balance, create, start, stop, status, history) via Hummingbot API. V1 focuses on cor... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 444 次。

如何安装 Hummingbot？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install hummingbot」即可一键安装，无需额外配置。

Hummingbot 是免费的吗？

是的，Hummingbot 完全免费（开源免费），可自由下载、安装和使用。

Hummingbot 支持哪些平台？

Hummingbot 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Hummingbot？

由 Michael Feng（@fengtality）开发并维护，当前版本 v1.0.1。

Hummingbot