← 返回 Skills 市场
fengtality

Hummingbot Deploy

作者 Michael Feng · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
418
总下载
0
收藏
2
当前安装
1
版本数
在 OpenClaw 中安装
/install hummingbot-deploy
功能描述
Deploy Hummingbot trading infrastructure including API server, MCP server, and Condor Telegram bot. Use this skill when the user wants to install, deploy, se...
使用说明 (SKILL.md)

hummingbot-deploy

Deploy the Hummingbot trading infrastructure. Before starting, explain to the user what will be installed:

What You're Installing

  1. Hummingbot API (Required): Your personal trading server that exposes a standardized REST API for trading, fetching market data, and deploying bot strategies across many CEXs and DEXs.

  2. Hummingbot MCP (Optional): MCP server that helps AI agents (Claude, Gemini, Codex, etc.) interact with Hummingbot API. Only needed if using AI agent CLIs.

  3. Condor (Optional): Terminal and Telegram-based UI for Hummingbot API.

Components

Component Repository
Hummingbot API hummingbot/hummingbot-api
MCP Server hummingbot/mcp
Condor hummingbot/condor

Pre-Installation Check

Only Hummingbot API is required. MCP and Condor are optional add-ons.

First, run the environment check to verify prerequisites:

bash \x3C(curl -s https://raw.githubusercontent.com/hummingbot/skills/main/skills/hummingbot-deploy/scripts/check_env.sh)

This checks: container detection, TTY, Docker, Docker Compose, Git, Make.

Install Hummingbot API

If ./hummingbot-api already exists, verify it's running by checking docker logs:

cd ./hummingbot-api && make deploy && sleep 2 && docker logs hummingbot-api 2>&1 | grep -i "uvicorn running"

If logs show "Uvicorn running", skip to "Install MCP Server". Otherwise, reset and reinstall.

Fresh install:

git clone https://github.com/hummingbot/hummingbot-api.git ./hummingbot-api
cd ./hummingbot-api

On regular machines (interactive TTY - check_env.sh shows "Interactive TTY: Yes"):

make setup    # Prompts for: API username, password, config password (defaults: admin/admin/admin)
make deploy

In containers (no TTY - check with [ -t 0 ] && echo "TTY" || echo "No TTY"):

# Set USER env var and create sudo shim if needed
export USER=${USER:-root}
[ "$(id -u)" = "0" ] && ! command -v sudo &>/dev/null && echo -e '#!/bin/bash\
while [[ "$1" == *=* ]]; do export "$1"; shift; done\
exec "$@"' > /usr/local/bin/sudo && chmod +x /usr/local/bin/sudo

# Create .env manually (skip interactive setup)
# Note: In containers, services communicate via Docker network (use container names, not localhost)
cat > .env \x3C\x3C EOF
API_USER=admin
API_PASS=admin
CONFIG_API_PASS=admin
DEBUG_MODE=false
BROKER_HOST=hummingbot-broker
BROKER_PORT=1883
BROKER_API_USER=admin
BROKER_PASSWORD=password
DATABASE_URL=postgresql+asyncpg://hbot:hummingbot-api@hummingbot-postgres:5432/hummingbot_api
BOTS_PATH=/hummingbot-api/bots
EOF

# Patch docker-compose.yml (bind mounts don't work in Docker-in-Docker)
sed -i 's|./bots:/hummingbot-api/bots|hummingbot-bots:/hummingbot-api/bots|g' docker-compose.yml
sed -i '/init-db.sql.*docker-entrypoint/d' docker-compose.yml
# Add volume definition (check last 5 lines to avoid false positive from service definition)
tail -5 docker-compose.yml | grep -q "hummingbot-bots:" || echo "  hummingbot-bots: { }" >> docker-compose.yml

touch .setup-complete
make deploy

Verify: Wait 2 seconds then check logs for "Uvicorn running on http://0.0.0.0:8000":

sleep 2 && docker logs hummingbot-api 2>&1 | grep -i "uvicorn running"

Install MCP Server

Install the MCP server using your CLI's native command. Use the same credentials from API setup.

IMPORTANT: Do NOT ask the user which CLI to use. You already know which CLI you are:

  • If you are Claude Code, use claude
  • If you are Gemini CLI, use gemini
  • If you are Codex CLI, use codex
bash \x3C(curl -s https://raw.githubusercontent.com/hummingbot/skills/main/skills/hummingbot-deploy/scripts/install_mcp.sh) \
  --agent \x3CYOUR_CLI> --user \x3CAPI_USER> --pass \x3CAPI_PASS>

Example for Claude (substitute your actual CLI name and credentials):

bash \x3C(curl -s https://raw.githubusercontent.com/hummingbot/skills/main/skills/hummingbot-deploy/scripts/install_mcp.sh) \
  --agent claude --user admin --pass admin

Installation Complete

After all components are installed, tell the user:

  1. Restart your AI agent (Claude Code, Gemini CLI, Codex CLI, etc.) to load the MCP server
  2. Install Hummingbot Skills to enable trading capabilities:
    npx skills add hummingbot/skills
    

Install Condor (Optional)

git clone https://github.com/hummingbot/condor.git ./condor
cd ./condor
bash setup-environment.sh  # Prompts for Telegram bot token
make deploy

Upgrade

cd ./hummingbot-api && git pull && make deploy

Verify Installation

bash \x3C(curl -s https://raw.githubusercontent.com/hummingbot/skills/main/skills/hummingbot-deploy/scripts/verify.sh)

Troubleshooting

# View logs
cd ./hummingbot-api && docker compose logs -f

# Reset
cd ./hummingbot-api && docker compose down -v && rm -rf ./hummingbot-api

See Also

安全使用建议
This skill appears to do what it claims (deploy Hummingbot), but it has several risky behaviors you should consider before running it: - Do not blindly run curl|bash on remote URLs. Instead, inspect the scripts included in the package (they are present) or fetch them over HTTPS and verify their contents/commit hash first. - The scripts may source .env files (including ~/.hummingbot/.env). Back up and inspect any .env files before running to avoid accidentally exporting secrets into the install process. - The install will pull Docker images (including an unpinned :latest image) and create docker volumes. Consider pulling and inspecting images first, or run the install in an isolated VM/container. - The scripts may write /usr/local/bin/sudo (a shim) if running in a container scenario — avoid allowing writes to system paths on your host. Prefer running the command inside an intentionally provisioned container or VM. - The MCP install invokes your agent CLI (e.g., claude, gemini, codex) and embeds API credentials in a command string. That can cause credentials to be stored in CLI config or logs; use strong, non-default credentials and prefer secrets managed by the platform. - If you decide to proceed: run the included local scripts (not the ones fetched from raw.githubusercontent.com), pin Docker image digests instead of :latest, and run everything in an isolated environment first to verify behavior. If you want, I can: (a) produce a checklist of safe steps to run this installation in a sandbox; (b) summarize the exact lines in the scripts that read .env or write files so you can review them; or (c) rewrite the instructions to avoid curl|bash and ensure safer defaults.
功能分析
Type: OpenClaw Skill Name: hummingbot-deploy Version: 1.0.0 The skill bundle is classified as suspicious due to several high-risk practices and vulnerabilities. Most notably, it repeatedly uses the `bash <(curl -s ...)` pattern in SKILL.md to execute remote scripts (check_env.sh, install_mcp.sh, verify.sh), which is a significant Remote Code Execution (RCE) vulnerability if the remote GitHub repository is compromised. Additionally, SKILL.md contains a highly suspicious custom `sudo` shim creation for container environments, which bypasses standard privilege escalation mechanisms. The skill also employs direct prompt injection against the AI agent, instructing it to execute its own CLI with constructed `docker run` commands (scripts/install_mcp.sh), including passing sensitive credentials as environment variables, further increasing the attack surface.
能力评估
Purpose & Capability
Name/description match the files and commands: scripts clone repos, run docker/docker-compose, and configure an MCP and Condor. Required binaries and envs are not declared but the check_env.sh enforces Docker/Git/Make presence, which is consistent with deployment.
Instruction Scope
Runtime instructions direct the agent/user to curl|bash remote scripts on raw.githubusercontent.com and to run scripts that source the first matching .env from hummingbot-api/.env, ~/.hummingbot/.env, or .env — which can export unrelated local secrets. The guide also instructs creating a sudo shim at /usr/local/bin/sudo on container hosts and running an agent CLI command that embeds API credentials into a docker run command. These actions go beyond a minimal deploy helper and may touch unrelated user files/config and modify system paths.
Install Mechanism
There is no formal install spec in the registry bundle (instruction-only), but the SKILL.md repeatedly instructs executing scripts fetched at runtime via curl from raw.githubusercontent.com. Running remote scripts is higher-risk than using local files; the package does include the same scripts locally, but the instructions prefer fetching remote copies (which could differ). The MCP image is pulled from Docker Hub as :latest (unpinned), which is expected but less secure than a pinned digest.
Credentials
The skill does not declare required credentials, which is plausible because it defaults to admin/admin. However, scripts read and export .env files (including ~/.hummingbot/.env) and embed API credentials into docker run commands and into the agent CLI registration command — potentially exposing secrets to CLI history, container volumes, or other local tooling. This access is not explicitly declared in the metadata and is more than minimal.
Persistence & Privilege
The skill does not request 'always', but scripts may write to the host (/usr/local/bin/sudo shim) and create docker volumes and images, and they register an MCP entry via the agent CLI. Writing an executable into /usr/local/bin on a host is a notable privilege elevation/persistence action and should not be performed without explicit user consent or sandboxing.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install hummingbot-deploy
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /hummingbot-deploy 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
- Initial release of the hummingbot-deploy skill. - Deploys Hummingbot trading infrastructure, including Hummingbot API (required), MCP server (optional), and Condor Telegram bot (optional). - Provides detailed installation, environment check, configuration, and verification instructions for each component. - Includes troubleshooting steps and links to official documentation. - Designed to support both regular machines and containerized environments.
元数据
Slug hummingbot-deploy
版本 1.0.0
许可证
累计安装 2
当前安装数 2
历史版本数 1
常见问题

Hummingbot Deploy 是什么?

Deploy Hummingbot trading infrastructure including API server, MCP server, and Condor Telegram bot. Use this skill when the user wants to install, deploy, se... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 418 次。

如何安装 Hummingbot Deploy?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install hummingbot-deploy」即可一键安装,无需额外配置。

Hummingbot Deploy 是免费的吗?

是的,Hummingbot Deploy 完全免费(开源免费),可自由下载、安装和使用。

Hummingbot Deploy 支持哪些平台?

Hummingbot Deploy 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Hummingbot Deploy?

由 Michael Feng(@fengtality)开发并维护,当前版本 v1.0.0。

💬 留言讨论