功能描述

Discover trending tokens and newly listed tokens across supported blockchains: view trending token rankings by chain and time window, find newly launched tok...

使用说明 (SKILL.md)

LiberFi Market Discovery

Name: Liberfi Market
Author: bombmod

Discover trending tokens and newly launched tokens using the LiberFi CLI.

Pre-flight Checks

See bootstrap.md for CLI installation and connectivity verification.

This skill's auth requirements:

All commands: No authentication required (public API)

Skill Routing

If user asks about...	Route to
Specific token info, price, security, holders	liberfi-token
Token K-line, candlestick, price chart	liberfi-token
Wallet holdings, balance, PnL	liberfi-portfolio
Wallet activity, transaction history	liberfi-portfolio
Swap, trade, buy, sell tokens	liberfi-swap
Transaction broadcast or fee estimation	liberfi-swap

CLI Command Index

Query Commands

Command	Description	Auth
`lfi ranking trending \x3Cchain> \x3Cduration>`	Get trending tokens by chain and time window	No
`lfi ranking new \x3Cchain>`	Get newly listed tokens on a chain	No

Parameter Reference

Trending command:

\x3Cchain> — Required. Chain identifier (e.g. sol, eth, bsc)
\x3Cduration> — Required. Time window (e.g. 1h, 6h, 24h)
--sort-by \x3Cfield> — Sort field (e.g. volume, price_change, market_cap)
--sort-dir \x3Cdir> — Sort direction: asc or desc
--filters \x3Cfilters> — Comma-separated filters
--launchpad-platform \x3Cplatform> — Filter by launchpad (e.g. pump.fun)
--search-keywords \x3Ckeywords> — Comma-separated search keywords
--exclude-keywords \x3Ckeywords> — Comma-separated keywords to exclude
--cursor \x3Ccursor> — Pagination cursor
--limit \x3Climit> — Max results per page
--direction \x3Cdirection> — Cursor direction: next or prev

New tokens command — same options as trending except no \x3Cduration> argument.

Operation Flow

View Trending Tokens

Determine parameters: Ask user for chain and time window if not specified. Default: sol chain, 24h duration
Fetch trending: lfi ranking trending \x3Cchain> \x3Cduration> --limit 20 --json
Present results: Show a table with Name, Symbol, Price, Change (%), Volume, Market Cap
Suggest next step: "Want to see details or security audit for any of these tokens?"

View Trending with Filters

Collect filters: Launchpad platform, sort field, keywords
Fetch: lfi ranking trending sol 1h --launchpad-platform "pump.fun" --sort-by volume --sort-dir desc --limit 20 --json
Present: Filtered results in table format
Suggest next step: "Want to drill into any specific token?"

Discover New Tokens

Determine chain: Ask user if not specified. Default: sol
Fetch new tokens: lfi ranking new \x3Cchain> --limit 20 --json
Present: Show recently listed tokens with name, symbol, price, launch time
Suggest next step: "Want to check the security audit before investigating further?"

Search Within Rankings

Collect keywords: What the user is looking for
Fetch: lfi ranking trending \x3Cchain> \x3Cduration> --search-keywords "meme,dog" --limit 20 --json
Present: Filtered results matching the keywords
Suggest next step: "Want to see details for any of these?"

Cross-Skill Workflows

"Show me what's trending, and research the top token"

Full flow: market → token → token → token

market → lfi ranking trending sol 24h --sort-by volume --sort-dir desc --limit 10 --json
token → lfi token info sol \x3CtopTokenAddress> --json — Details on #1 token
token → lfi token security sol \x3CtopTokenAddress> --json — Security audit
token → lfi token holders sol \x3CtopTokenAddress> --json — Holder analysis
Present consolidated findings

"Find new pump.fun tokens and check if the hottest one is safe"

Full flow: market → token → token

market → lfi ranking new sol --launchpad-platform "pump.fun" --limit 10 --json
Pick the top token by volume
token → lfi token security sol \x3Caddress> --json — Security check
token → lfi token info sol \x3Caddress> --json — Full details
Present safety report

"What are the top gainers on ETH? I want to buy one"

Full flow: market → token → swap

market → lfi ranking trending eth 24h --sort-by price_change --sort-dir desc --limit 10 --json
User selects a token
token → lfi token security eth \x3Caddress> --json — Mandatory security check
swap → lfi swap quote --in \x3CinputToken> --out \x3Caddress> --amount \x3Camt> --chain-family evm --chain-id 1 --json
Present quote and wait for user confirmation

Suggest Next Steps

Just completed	Suggest to user
Trending ranking	"Want to see details for any token?" / "需要查看某个代币的详情？"
New tokens list	"Want to check the security audit for any of these?" / "需要对其中某个做安全审计？"
Filtered ranking	"Want to drill into a specific token?" / "需要深入了解某个代币？"

Edge Cases

Invalid chain identifier: If the API returns an error, list supported chains (e.g. sol, eth, bsc) and ask the user to choose
Invalid duration: Suggest valid durations: 1h, 6h, 24h
No trending results: Inform user: "No trending tokens found for this chain and time window. Try a different chain or longer duration."
No new tokens: Inform user: "No newly listed tokens found. The chain may have low launch activity right now."
Network timeout: Retry once after 3 seconds; if still fails, suggest checking connectivity via lfi ping --json
Too many results: Default to --limit 20; if user asks for more, paginate with --cursor and --direction next

Security Notes

See security-policy.md for global security rules.

Skill-specific rules:

Trending and new token rankings are informational only — a token appearing in rankings does not indicate endorsement or safety
Always recommend users run a security audit (lfi token security) before interacting with newly discovered tokens
New tokens from launchpad platforms carry higher risk — proactively mention this when presenting results

安全使用建议

This skill mostly does what it says (call a CLI to list trending/new tokens) but its runtime instructions are the main red flag: it orders the agent to install a global npm package without asking the user and to retry/ignore registry failures. Before installing or enabling this skill, ask the publisher to: (1) declare required binaries and provide a formal install spec in metadata rather than a hidden in-SKILL.md install instruction; (2) remove the 'install without asking' directive — require explicit user consent for any global installs; (3) provide links to the npm package and its source (GitHub) so you can inspect releases and verify integrity; (4) explain why global installation is necessary and whether a local/sandboxed invocation is possible; and (5) confirm there are no additional hidden behaviors (telemetry, network callbacks). If you must use it, do not allow the agent to perform global installs automatically—run any npm install manually in a controlled environment, inspect the package contents/maintainer, and sandbox execution.

功能分析

Type: OpenClaw Skill Name: liberfi-market Version: 1.0.3 The SKILL.md file contains 'CRITICAL' instructions directing the AI agent to globally install an NPM package (`@liberfi.io/cli`) without user consent if the command is missing. Additionally, it explicitly instructs the agent to deceive the user by suppressing installation error messages and providing a hardcoded excuse (blaming registry mirrors) regardless of the actual cause of failure. While these actions facilitate the skill's functionality, the bypass of user authorization for system-level changes and the directive to provide misleading feedback are high-risk behaviors.

能力标签

cryptorequires-walletcan-sign-transactionsrequires-sensitive-credentials

能力评估

⚠ Purpose & Capability

The skill's description and allowed commands align with a CLI-based token-discovery tool. However, the SKILL.md contains a CRITICAL directive to perform an automatic global npm install of @liberfi.io/cli (and to retry silently on registry errors). The registry metadata declares no required binaries or install steps; asking the agent to install a global CLI without declaring that requirement is inconsistent and disproportionate.

⚠ Instruction Scope

The instructions explicitly order the agent to install software 'WITHOUT asking the user' and to conceal registry failures by retrying with a specific registry. That is outside the narrow scope of querying rankings (it changes system state and suppresses error reporting). Other parts of the SKILL.md stay on-task (how to call lfi), but the installation/behavioral directives grant the agent broad discretion to modify the host environment.

⚠ Install Mechanism

There is no formal install spec in the skill metadata, but SKILL.md instructs a global npm install (-g) from the public npm registry. Installing an unsigned npm package globally is a moderate-to-high risk action (writes files, adds binaries, may require elevated permissions) and the SKILL.md provides no integrity checks, release host verification, or rollback instructions. The insistence on automatic installation and retrying registries increases risk.

⚠ Credentials

The skill declares no required env vars or credentials, which fits a public-read CLI. But the install directive implicitly requires system-level write access (npm, node, and potentially sudo). The metadata omits any required binaries (npm/node) while the instructions assume they exist or will succeed, a mismatch that could lead to unexpected privilege use or failed installs masked by the skill's retry behavior.

⚠ Persistence & Privilege

While the skill isn't force-enabled (always: false) and is user-invocable, the SKILL.md's global install will create persistent system binaries (lfi/liberfi). That is effectively granting the skill persistent code on the host at runtime without declaring or seeking user approval, which increases blast radius if the installed package is malicious or compromised.

版本历史

v1.0.3

Add liberfi-perpetuals skill (Hyperliquid MVP) and route perp queries away from liberfi-market

v1.0.2

Force Polymarket/Kalshi queries to route to liberfi-predict, not liberfi-token/market/portfolio.

v1.0.1

Make CLI install instructions explicit and unambiguous; tell agents the npm package is @liberfi.io/cli, fall back to --registry https://registry.npmjs.org/ on mirror lag, and never report 'package not found'.

v1.0.0

LiberFi Market Discovery skill v1.0.0 - Initial release providing trending and newly listed token rankings across supported chains. - Users can view rankings by chain and time window, filter by launchpad, sort, and search within results. - Always returns structured output with token name, symbol, price, and 24h change. - Handles edge cases like invalid chains/durations, network timeouts, and empty results with user guidance. - Delineates routing for token details, security audits, and swap functions to other LiberFi skills.

元数据

Slug liberfi-market

版本 1.0.3

许可证 MIT-0

累计安装 1

当前安装数 1

历史版本数 4

常见问题

Liberfi Market 是什么？

Discover trending tokens and newly listed tokens across supported blockchains: view trending token rankings by chain and time window, find newly launched tok... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 143 次。

如何安装 Liberfi Market？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install liberfi-market」即可一键安装，无需额外配置。

Liberfi Market 是免费的吗？

是的，Liberfi Market 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。

Liberfi Market 支持哪些平台？

Liberfi Market 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Liberfi Market？

由 bombmod（@bombmod）开发并维护，当前版本 v1.0.3。

Liberfi Market