ClawHub

Phemex Trade

v1.2.0

Trade on Phemex (USDT-M futures, Coin-M futures, Spot) — place orders, manage positions, check balances, and query market data. Use when the user wants to (1...

⭐ 0· 728·2 current·2 all-time
byaaron liu@bubble501
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, required binaries (phemex-cli), declared env vars (PHEMEX_API_KEY, PHEMEX_API_SECRET), and the install (npm package phemex-trade-mcp creating phemex-cli) are coherent for a Phemex trading CLI.
ℹ
Instruction Scope
SKILL.md instructs using phemex-cli commands and documents that credentials may be persisted to ~/.phemexrc; this is expected for a CLI but is a useful security consideration since it writes secrets to disk.
ℹ
Install Mechanism
Install is an npm package (phemex-trade-mcp) that provides the phemex-cli binary. npm installs can run arbitrary code during installation (moderate risk). Using an npm package for a CLI is reasonable, but users should vet the package source/maintainer before global install.
✓
Credentials
Only PHEMEX_API_KEY and PHEMEX_API_SECRET are required and are expected for trading functionality. The SKILL.md's use of ~/.phemexrc to persist credentials is consistent with the declared env usage.
✓
Persistence & Privilege
Skill is not marked always:true and does not request elevated system-wide privileges. It may store credentials in ~/.phemexrc (its own config), which is normal for a CLI but should be guarded by the user.
Assessment
This skill appears to do what it says: act as a wrapper around a Phemex CLI. Before installing, verify the npm package and GitHub repo (maintainer, recent commits, issues) and prefer creating exchange API keys with minimal permissions. Be aware the CLI can persist secrets to ~/.phemexrc — review that file's contents and filesystem permissions, or prefer passing credentials via environment variables at runtime. Because npm installs execute code, consider auditing the package source or installing in a restricted/isolated environment (container or VM) if you are unsure.

Like a lobster shell, security has layers — review code before you run it.

latestvk9733mq6hsbh4f05hfx1kk0sjx8318t2

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📈 Clawdis
Binsphemex-cli
EnvPHEMEX_API_KEY, PHEMEX_API_SECRET
Primary envPHEMEX_API_KEY

Install

Install Phemex CLI (node)
Bins: phemex-cli
npm i -g phemex-trade-mcp

Comments