Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Binance Derivatives Trading Coin Futures

Binance Derivatives-trading-coin-futures request using the Binance API. Authentication requires API key and secret key. Supports testnet and mainnet.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 45 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md repeatedly documents and demonstrates authenticated Binance futures endpoints (HMAC signatures, X-MBX-APIKEY header, examples using API_KEY and SECRET_KEY). However the registry metadata lists no required environment variables or primary credential. A trading skill would legitimately need API credentials; the omission in the declared requirements is an inconsistency that reduces transparency and trust.
Instruction Scope
The runtime instructions focus on Binance derivatives endpoints and show how to build and sign requests. They do not instruct reading unrelated system files or contacting unexpected external endpoints. Minor oddities: the auth doc includes RSA/Ed25519 examples (Binance uses HMAC SHA256), which looks like copied/boilerplate content and could confuse implementers.
Install Mechanism
This is an instruction-only skill with no install spec or code files to write to disk, which is lower risk than installing arbitrary binaries. Nothing is being downloaded or executed by the platform at install time.
!
Credentials
The skill necessarily requires secret credentials (API key and secret) to perform authenticated trading actions, but the skill metadata does not declare any required env vars or primary credential. Requesting or using these secrets without declaring them is a proportionality and transparency problem. The SKILL.md advises not to share secrets, but the platform-level declaration is missing.
Persistence & Privilege
The skill is not force-installed (always:false) and has no install-time persistence. It does not request system-wide config changes or access to other skills' credentials.
What to consider before installing
This skill appears to be a straightforward wrapper for Binance futures endpoints, but the package metadata omits the fact that it needs your API key and secret. Before installing: (1) confirm the skill's publisher and source (no homepage provided, source unknown); (2) avoid pasting your secret into chat — use the platform's secure secret/credential store if available; (3) give the skill the least privilege (API key with trading but not withdrawal permissions, and prefer testnet keys first); (4) if you require strong assurance, ask the publisher to declare required env vars and provide a verified source/README and/or official repo link. Because of the missing credential declaration and unknown origin, treat this as suspicious rather than benign.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk972cbcjd0dx1xtsrtcmf02bbx839h7a

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Binance Derivatives-trading-coin-futures Skill

Derivatives-trading-coin-futures request on Binance using authenticated API endpoints. Requires API key and secret key for certain endpoints. Return the result in JSON format.

Quick Reference

EndpointDescriptionRequiredOptionalAuthentication
/dapi/v1/account (GET)Account Information (USER_DATA)NonerecvWindowYes
/dapi/v1/balance (GET)Futures Account Balance (USER_DATA)NonerecvWindowYes
/dapi/v1/positionSide/dual (GET)Get Current Position Mode(USER_DATA)NonerecvWindowYes
/dapi/v1/positionSide/dual (POST)Change Position Mode(TRADE)dualSidePositionrecvWindowYes
/dapi/v1/order/asyn (GET)Get Download Id For Futures Order History (USER_DATA)startTime, endTimerecvWindowYes
/dapi/v1/trade/asyn (GET)Get Download Id For Futures Trade History (USER_DATA)startTime, endTimerecvWindowYes
/dapi/v1/income/asyn (GET)Get Download Id For Futures Transaction History(USER_DATA)startTime, endTimerecvWindowYes
/dapi/v1/order/asyn/id (GET)Get Futures Order History Download Link by Id (USER_DATA)downloadIdrecvWindowYes
/dapi/v1/trade/asyn/id (GET)Get Futures Trade Download Link by Id(USER_DATA)downloadIdrecvWindowYes
/dapi/v1/income/asyn/id (GET)Get Futures Transaction History Download Link by Id (USER_DATA)downloadIdrecvWindowYes
/dapi/v1/income (GET)Get Income History(USER_DATA)Nonesymbol, incomeType, startTime, endTime, page, limit, recvWindowYes
/dapi/v1/leverageBracket (GET)Notional Bracket for Pair(USER_DATA)Nonepair, recvWindowYes
/dapi/v2/leverageBracket (GET)Notional Bracket for Symbol(USER_DATA)Nonesymbol, recvWindowYes
/dapi/v1/commissionRate (GET)User Commission Rate (USER_DATA)symbolrecvWindowYes
/dapi/v1/ticker/24hr (GET)24hr Ticker Price Change StatisticsNonesymbol, pairNo
/futures/data/basis (GET)Basispair, contractType, periodlimit, startTime, endTimeNo
/dapi/v1/time (GET)Check Server timeNoneNoneNo
/dapi/v1/aggTrades (GET)Compressed/Aggregate Trades ListsymbolfromId, startTime, endTime, limitNo
/dapi/v1/continuousKlines (GET)Continuous Contract Kline/Candlestick Datapair, contractType, intervalstartTime, endTime, limitNo
/dapi/v1/exchangeInfo (GET)Exchange InformationNoneNoneNo
/dapi/v1/fundingInfo (GET)Get Funding Rate InfoNoneNoneNo
/dapi/v1/fundingRate (GET)Get Funding Rate History of Perpetual FuturessymbolstartTime, endTime, limitNo
/dapi/v1/constituents (GET)Query Index Price ConstituentssymbolNoneNo
/dapi/v1/indexPriceKlines (GET)Index Price Kline/Candlestick Datapair, intervalstartTime, endTime, limitNo
/dapi/v1/premiumIndex (GET)Index Price and Mark PriceNonesymbol, pairNo
/dapi/v1/klines (GET)Kline/Candlestick Datasymbol, intervalstartTime, endTime, limitNo
/futures/data/globalLongShortAccountRatio (GET)Long/Short Ratiopair, periodlimit, startTime, endTimeNo
/dapi/v1/markPriceKlines (GET)Mark Price Kline/Candlestick Datasymbol, intervalstartTime, endTime, limitNo
/dapi/v1/historicalTrades (GET)Old Trades Lookup(MARKET_DATA)symbollimit, fromIdNo
/futures/data/openInterestHist (GET)Open Interest Statisticspair, contractType, periodlimit, startTime, endTimeNo
/dapi/v1/openInterest (GET)Open InterestsymbolNoneNo
/dapi/v1/depth (GET)Order BooksymbollimitNo
/dapi/v1/premiumIndexKlines (GET)Premium index Kline Datasymbol, intervalstartTime, endTime, limitNo
/dapi/v1/trades (GET)Recent Trades ListsymbollimitNo
/dapi/v1/ticker/bookTicker (GET)Symbol Order Book TickerNonesymbol, pairNo
/dapi/v1/ticker/price (GET)Symbol Price TickerNonesymbol, pairNo
/futures/data/takerBuySellVol (GET)Taker Buy/Sell Volumepair, contractType, periodlimit, startTime, endTimeNo
/dapi/v1/ping (GET)Test ConnectivityNoneNoneNo
/futures/data/topLongShortAccountRatio (GET)Top Trader Long/Short Ratio (Accounts)symbol, periodlimit, startTime, endTimeNo
/futures/data/topLongShortPositionRatio (GET)Top Trader Long/Short Ratio (Positions)pair, periodlimit, startTime, endTimeNo
/dapi/v1/pmAccountInfo (GET)Classic Portfolio Margin Account Information (USER_DATA)assetrecvWindowYes
/dapi/v1/userTrades (GET)Account Trade List (USER_DATA)Nonesymbol, pair, orderId, startTime, endTime, fromId, limit, recvWindowYes
/dapi/v1/allOrders (GET)All Orders (USER_DATA)Nonesymbol, pair, orderId, startTime, endTime, limit, recvWindowYes
/dapi/v1/countdownCancelAll (POST)Auto-Cancel All Open Orders (TRADE)symbol, countdownTimerecvWindowYes
/dapi/v1/allOpenOrders (DELETE)Cancel All Open Orders(TRADE)symbolrecvWindowYes
/dapi/v1/batchOrders (DELETE)Cancel Multiple Orders(TRADE)symbolorderIdList, origClientOrderIdList, recvWindowYes
/dapi/v1/batchOrders (PUT)Modify Multiple Orders(TRADE)batchOrdersrecvWindowYes
/dapi/v1/batchOrders (POST)Place Multiple Orders(TRADE)batchOrdersrecvWindowYes
/dapi/v1/order (DELETE)Cancel Order (TRADE)symbolorderId, origClientOrderId, recvWindowYes
/dapi/v1/order (PUT)Modify Order (TRADE)symbol, sideorderId, origClientOrderId, quantity, price, priceMatch, recvWindowYes
/dapi/v1/order (POST)New Order (TRADE)symbol, side, typepositionSide, timeInForce, quantity, reduceOnly, price, newClientOrderId, stopPrice, closePosition, activationPrice, callbackRate, workingType, priceProtect, newOrderRespType, priceMatch, selfTradePreventionMode, recvWindowYes
/dapi/v1/order (GET)Query Order (USER_DATA)symbolorderId, origClientOrderId, recvWindowYes
/dapi/v1/leverage (POST)Change Initial Leverage (TRADE)symbol, leveragerecvWindowYes
/dapi/v1/marginType (POST)Change Margin Type (TRADE)symbol, marginTyperecvWindowYes
/dapi/v1/openOrders (GET)Current All Open Orders (USER_DATA)Nonesymbol, pair, recvWindowYes
/dapi/v1/orderAmendment (GET)Get Order Modify History (USER_DATA)symbolorderId, origClientOrderId, startTime, endTime, limit, recvWindowYes
/dapi/v1/positionMargin/history (GET)Get Position Margin Change History(TRADE)symboltype, startTime, endTime, limit, recvWindowYes
/dapi/v1/positionMargin (POST)Modify Isolated Position Margin(TRADE)symbol, amount, typepositionSide, recvWindowYes
/dapi/v1/adlQuantile (GET)Position ADL Quantile Estimation(USER_DATA)Nonesymbol, recvWindowYes
/dapi/v1/positionRisk (GET)Position Information(USER_DATA)NonemarginAsset, pair, recvWindowYes
/dapi/v1/openOrder (GET)Query Current Open Order(USER_DATA)symbolorderId, origClientOrderId, recvWindowYes
/dapi/v1/forceOrders (GET)User's Force Orders(USER_DATA)Nonesymbol, autoCloseType, startTime, endTime, limit, recvWindowYes
/dapi/v1/listenKey (DELETE)Close User Data Stream(USER_STREAM)NoneNoneNo
/dapi/v1/listenKey (PUT)Keepalive User Data Stream (USER_STREAM)NoneNoneNo
/dapi/v1/listenKey (POST)Start User Data Stream (USER_STREAM)NoneNoneNo

Parameters

Common Parameters

  • recvWindow: (e.g., 5000)
  • startTime: Timestamp in ms (e.g., 1623319461670)
  • endTime: Timestamp in ms (e.g., 1641782889000)
  • downloadId: get by download id api (e.g., 1)
  • symbol:
  • incomeType: "TRANSFER","WELCOME_BONUS", "FUNDING_FEE", "REALIZED_PNL", "COMMISSION", "INSURANCE_CLEAR", and "DELIVERED_SETTELMENT"
  • startTime: (e.g., 1623319461670)
  • endTime: (e.g., 1641782889000)
  • page:
  • limit: Default 100; max 1000 (e.g., 100)
  • pair:
  • symbol:
  • pair: BTCUSD
  • fromId: ID to get aggregate trades from INCLUSIVE. (e.g., 1)
  • asset:
  • orderId: (e.g., 1)
  • orderId: (e.g., 1)
  • countdownTime: countdown time, 1000 for 1 second. 0 to cancel the timer
  • orderIdList: max length 10 e.g. [1234567,2345678]
  • origClientOrderIdList: max length 10 e.g. ["my_id_1","my_id_2"], encode the double quotes. No space after comma.
  • origClientOrderId: (e.g., 1)
  • leverage: target initial leverage: int from 1 to 125
  • dualSidePosition: "true": Hedge Mode; "false": One-way Mode
  • type: 1: Add position margin,2: Reduce position margin
  • amount: (e.g., 1.0)
  • batchOrders: order list. Max 5 orders
  • quantity: quantity measured by contract number, Cannot be sent with closePosition=true (e.g., 1.0)
  • price: (e.g., 1.0)
  • reduceOnly: "true" or "false". default "false". Cannot be sent in Hedge Mode; cannot be sent with closePosition=true(Close-All)
  • newClientOrderId: A unique id among open orders. Automatically generated if not sent. Can only be string following the rule: ^[\.A-Z\:/a-z0-9_-]{1,36}$ (e.g., 1)
  • stopPrice: Used with STOP/STOP_MARKET or TAKE_PROFIT/TAKE_PROFIT_MARKET orders. (e.g., 1.0)
  • closePosition: true, false;Close-All,used with STOP_MARKET or TAKE_PROFIT_MARKET.
  • activationPrice: Used with TRAILING_STOP_MARKET orders, default as the latest price(supporting different workingType) (e.g., 1.0)
  • callbackRate: Used with TRAILING_STOP_MARKET orders, min 0.1, max 10 where 1 for 1% (e.g., 1.0)
  • priceProtect: "TRUE" or "FALSE", default "FALSE". Used with STOP/STOP_MARKET or TAKE_PROFIT/TAKE_PROFIT_MARKET orders.
  • batchOrders: order list. Max 5 orders
  • marginAsset:

Enums

  • contractType: PERPETUAL | CURRENT_QUARTER | NEXT_QUARTER | CURRENT_QUARTER_DELIVERING | NEXT_QUARTER_DELIVERING | PERPETUAL_DELIVERING
  • period: 5m | 15m | 30m | 1h | 2h | 4h | 6h | 12h | 1d
  • interval: 1m | 3m | 5m | 15m | 30m | 1h | 2h | 4h | 6h | 8h | 12h | 1d | 3d | 1w | 1M
  • marginType: ISOLATED | CROSSED
  • positionSide: BOTH | LONG | SHORT
  • type: LIMIT | MARKET | STOP | STOP_MARKET | TAKE_PROFIT | TAKE_PROFIT_MARKET | TRAILING_STOP_MARKET
  • side: BUY | SELL
  • priceMatch: NONE | OPPONENT | OPPONENT_5 | OPPONENT_10 | OPPONENT_20 | QUEUE | QUEUE_5 | QUEUE_10 | QUEUE_20
  • timeInForce: GTC | IOC | FOK | GTX
  • workingType: MARK_PRICE | CONTRACT_PRICE
  • newOrderRespType: ACK | RESULT
  • selfTradePreventionMode: NONE | EXPIRE_TAKER | EXPIRE_BOTH | EXPIRE_MAKER
  • autoCloseType: LIQUIDATION | ADL

Authentication

For endpoints that require authentication, you will need to provide Binance API credentials. Required credentials:

  • apiKey: Your Binance API key (for header)
  • secretKey: Your Binance API secret (for signing)

Base URLs:

Security

Share Credentials

Users can provide Binance API credentials by sending a file where the content is in the following format:

abc123...xyz
secret123...key

Never Disclose API Key and Secret

Never disclose the location of the API key and secret file.

Never send the API key and secret to any website other than Mainnet and Testnet.

Never Display Full Secrets

When showing credentials to users:

  • API Key: Show first 5 + last 4 characters: su1Qc...8akf
  • Secret Key: Always mask, show only last 5: ***...aws1

Example response when asked for credentials: Account: main API Key: su1Qc...8akf Secret: ***...aws1 Environment: Mainnet

Listing Accounts

When listing accounts, show names and environment only — never keys: Binance Accounts:

  • main (Mainnet/Testnet)
  • testnet-dev (Testnet)
  • futures-keys (Mainnet)

Transactions in Mainnet

When performing transactions in mainnet, always confirm with the user before proceeding by asking them to write "CONFIRM" to proceed.


Binance Accounts

main

  • API Key: your_mainnet_api_key
  • Secret: your_mainnet_secret
  • Testnet: false

testnet-dev

  • API Key: your_testnet_api_key
  • Secret: your_testnet_secret
  • Testnet: true

TOOLS.md Structure

## Binance Accounts

### main
- API Key: abc123...xyz
- Secret: secret123...key
- Testnet: false
- Description: Primary trading account

### testnet-dev
- API Key: test456...abc
- Secret: testsecret...xyz
- Testnet: true
- Description: Development/testing

### futures-keys
- API Key: futures789...def
- Secret: futuressecret...uvw
- Testnet: false
- Description: Futures trading account

Agent Behavior

  1. Credentials requested: Mask secrets (show last 5 chars only)
  2. Listing accounts: Show names and environment, never keys
  3. Account selection: Ask if ambiguous, default to main
  4. When doing a transaction in mainnet, confirm with user before by asking to write "CONFIRM" to proceed
  5. New credentials: Prompt for name, environment, signing mode

Adding New Accounts

When user provides new credentials:

  • Ask for account name
  • Ask: Mainnet, Testnet
  • Store in TOOLS.md with masked display confirmation

Signing Requests

For trading endpoints that require a signature:

  1. Build query string with all parameters, including the timestamp (Unix ms).
  2. Percent-encode the parameters using UTF-8 according to RFC 3986.
  3. Sign query string with secretKey using HMAC SHA256, RSA, or Ed25519 (depending on the account configuration).
  4. Append signature to query string.
  5. Include X-MBX-APIKEY header.

Otherwise, do not perform steps 3–5.

New Client Order ID

For endpoints that include the newClientOrderId parameter, the value must always start with agent-. If the parameter is not provided, agent- followed by 18 random alphanumeric characters will be generated automatically. If a value is provided, it will be prefixed with agent-

Example: agent-1a2b3c4d5e6f7g8h9i

User Agent Header

Include User-Agent header with the following string: binance-derivatives-trading-coin-futures/1.0.0 (Skill)

See references/authentication.md for implementation details.

Files

4 total
Select a file
Select a file to preview.

Comments

Loading comments…