← 返回 Skills 市场
Weex
作者
iiiiicooper
· GitHub ↗
· v1.0.1
· MIT-0
115
总下载
1
收藏
0
当前安装
2
版本数
在 OpenClaw 中安装
/install weex
功能描述
Automated trading tool for WEEX API, supporting futures and spot trading, including natural language order placement, order cancellation, order query, market...
安全使用建议
This skill appears to be a real WEEX trading client (spot + futures) implemented as local Python scripts. Before installing or providing real API credentials:
- Treat the registry metadata mismatch as a red flag: SKILL.md and the scripts require WEEX_API_KEY / WEEX_API_SECRET / WEEX_API_PASSPHRASE even though the registry lists none. Don’t rely solely on the registry declarations.
- Do not provide your main account keys. Create a least-privilege API key for testing (disable withdrawals; limit permissions to read and trading only if needed).
- Inspect the scripts yourself (they are included) to confirm there are no hardcoded exfil endpoints or logging of secrets. The provided files appear to call the weex.com API and fetch docs from weex.com — expected for this skill.
- Test in dry-run / sandbox first: manually run the scripts locally with test keys or in a sandbox account to verify behavior. The SKILL.md expects the agent to include --confirm-live for mutating actions; be explicit in prompts and review generated CLI before execution.
- Because the agent is responsible for mapping natural language to CLI flags, prefer explicit structured prompts (e.g., specify exact --confirm-live or --no-execute) and review any generated command before it runs.
- If you plan to use this in an automated/agent setting, require an explicit confirmation step for any live trade, rotate keys if exposed, and consider running the skill in an isolated environment.
If you want a cleaner integration: ask the skill author to update the registry metadata to declare the required env vars and set a primary credential, and to clarify the default/dry-run behavior to avoid ambiguity around live execution.
功能分析
Type: OpenClaw Skill
Name: weex
Version: 1.0.1
The skill bundle is a legitimate trading tool for the WEEX cryptocurrency exchange, providing automated interfaces for spot and contract trading. The scripts (weex_contract_api.py and weex_spot_api.py) implement standard HMAC-SHA256 request signing and interact only with official WEEX API endpoints (api-contract.weex.com and api-spot.weex.com). Security measures are present, including the masking of sensitive API credentials in debug output and a safety policy in SKILL.md that requires an explicit '--confirm-live' flag for mutating operations like placing or cancelling orders. No evidence of data exfiltration, malicious execution, or prompt injection was found.
能力评估
Purpose & Capability
Name/description match the included files: the repo contains spot and contract API wrappers, local endpoint definitions, signing docs, and helper scripts — all expected for a WEEX trading skill. However, the registry metadata claims no required environment variables or primary credential while the SKILL.md and code clearly expect WEEX_API_KEY, WEEX_API_SECRET, WEEX_API_PASSPHRASE (and optional WEEX_API_BASE/WEEX_LOCALE). That mismatch is an incoherence in the packaging/metadata.
Instruction Scope
SKILL.md gives concrete commands to run the included Python scripts and documents that private endpoints require env vars. It does not instruct reading arbitrary host files or unrelated credentials. Two concerns: (1) SKILL.md says 'Default flow is direct live execution (no dry-run step)' while also requiring '--confirm-live' for mutating requests — this is ambiguous and could lead to accidental live trades if the agent omits the flag; (2) the agent is expected to translate natural language into CLI flags (the agent layer does this), which gives broad discretion to the agent to craft mutating commands. Both are relevant operational risks for a trading skill but are within the domain of the stated purpose.
Install Mechanism
No install spec; the skill is instruction-only plus Python scripts present. That means nothing is auto-downloaded at install time. The included scripts are local and self-contained; no external arbitrary binary downloads were observed in the manifest.
Credentials
The scripts legitimately require API credentials (KEY, SECRET, PASSPHRASE) and optionally base URL/timeout/locale — those are proportionate for a trading integration. The problem is metadata: the registry lists no required env vars or primary credential, while SKILL.md and references clearly require and read env vars. This inconsistency can mislead users or automated gate checks that rely on declared requirements. Also, the skill requests full trading capability (place/cancel orders, adjust margin), so you should use least-privilege keys (no withdrawal permission).
Persistence & Privilege
always is false and there is no install behavior that modifies other skills or system configuration. The skill does not request permanent platform-level privileges. It will run Python scripts when invoked, which is expected for this kind of skill.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install weex - 安装完成后，直接呼叫该 Skill 的名称或使用
/weex触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.1
Update description to English
v1.0.0
初始版本发布，支持 WEEX 合约和现货 V3 API 自动化交易
元数据
常见问题
Weex 是什么？
Automated trading tool for WEEX API, supporting futures and spot trading, including natural language order placement, order cancellation, order query, market... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 115 次。
如何安装 Weex？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install weex」即可一键安装，无需额外配置。
Weex 是免费的吗？
是的，Weex 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Weex 支持哪些平台？
Weex 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Weex？
由 iiiiicooper（@iiiiicooper）开发并维护，当前版本 v1.0.1。
推荐 Skills