Binance Dca Tool

Binance Dollar-Cost Averaging (DCA) tool for automated and manual recurring crypto purchases. Use when the user wants to plan DCA strategies, execute recurring buys on Binance, check DCA projections, view trade history, or manage a systematic buying schedule for any trading pair (BTC/USDT, ETH/USDT, etc). Triggers on requests about DCA, recurring buys, cost averaging, accumulation strategies, or Binance spot purchases.

Security Scan

The skill's code matches a Binance DCA tool, but the package metadata omits required API credentials and the runtime instructions contain contradictory and risky guidance (e.g., embedding keys in cron), so the bundle is internally inconsistent and requires caution.

Purpose & Capability

The script and SKILL.md clearly require BINANCE_API_KEY and BINANCE_SECRET_KEY to perform Binance account actions, but the registry metadata declares no required env vars or primary credential. That mismatch is incoherent — a Binance trading tool legitimately needs API credentials and should declare them.

Instruction Scope

SKILL.md and the included script stay within Binance trading scope (price, balance, buy, history, plan), but the documentation contradicts itself: it advises 'Never store credentials' while showing a cron example that places API keys inline in the cron command. The doc also suggests using 'OpenClaw cron' for agent-managed scheduling (which may cause the agent to store scheduling config) without clarifying how secrets are protected. No instructions request unrelated files, but the cron example risks exposing secrets.

Install Mechanism

There is no install spec (instruction-only with an included shell script), which minimizes install risk. The script will be written to disk as provided by the skill bundle; there is no external download or opaque installer. Review the included script before running.

Credentials

The script requires sensitive credentials (BINANCE_API_KEY, BINANCE_SECRET_KEY) but the skill metadata lists none; this omission prevents automated vetting of required secrets. The SKILL.md also suggests embedding keys directly in cron (exposes secrets to process lists/logs) and recommends agent-managed scheduling without explaining secret handling. The skill permits overriding BASE_URL, which is legitimate for testnet but could be misused if set to a malicious endpoint.

Persistence & Privilege

always is false and the skill does not request system-wide privileges or modify other skills. It does not claim permanent/global presence; autonomous invocation remains at the platform default.

What to consider before installing

This bundle contains a straightforward Binance DCA shell script, but there are important red flags you should address before using it: (1) The registry metadata fails to declare required credentials — the script needs BINANCE_API_KEY and BINANCE_SECRET_KEY; do not rely on metadata alone. (2) Never put API keys directly into cron command lines or source-controlled files: that exposes them in shell history, process lists, and logs. Use a secure vault or environment injection mechanism, and prefer ephemeral/testnet keys when trying the tool. (3) Ensure any API key used has the minimum permissions (e.g., ENABLE_TRADING but NOT WITHDRAWALS) and enable IP whitelist where possible. (4) Verify BINANCE_BASE_URL is not set to an untrusted endpoint before running (the tool will send signed requests to whatever BASE_URL is provided). (5) Review the included scripts locally before executing; confirm the signing (openssl HMAC) and curl calls behave as expected. (6) Ask the publisher (or require an updated package) to fix the metadata to declare the required credentials and to remove or replace the insecure cron example. If you cannot validate the source and correct these issues, treat the skill as risky and avoid granting it secrets or running it on production accounts.

Binance DCA

Execute and plan Dollar-Cost Averaging strategies on Binance.

Setup

Requires two environment variables (never hardcode these):

export BINANCE_API_KEY="your-key"
export BINANCE_SECRET_KEY="your-secret"

Optional: BINANCE_BASE_URL (defaults to https://api.binance.com). Use https://testnet.binance.vision for paper trading.

Quick Start

# Check current BTC price
bash scripts/dca.sh price BTCUSDT

# Project a DCA plan: $50 every 7 days, 12 buys
bash scripts/dca.sh plan 50 7 12 BTCUSDT

# Execute a $50 market buy
bash scripts/dca.sh buy BTCUSDT 50

# Check recent trades
bash scripts/dca.sh history BTCUSDT 10

# Check USDT balance
bash scripts/dca.sh balance USDT

Actions

price [SYMBOL]

Get current spot price. Default: BTCUSDT.

balance [ASSET]

Check free and locked balance for an asset. Default: USDT.

buy SYMBOL AMOUNT [TYPE] [PRICE]

Place a buy order. AMOUNT is in quote currency (USDT).

• MARKET (default): Execute immediately at market price
• LIMIT: Requires price parameter — buy BTCUSDT 50 LIMIT 95000

history [SYMBOL] [LIMIT]

Show recent trades with timestamps, side, quantity, price, and fees.

plan [AMOUNT] [FREQ_DAYS] [NUM_BUYS] [SYMBOL]

Project a DCA plan with scenario analysis showing PnL at different price levels (-30% to +100%). Defaults: $50, every 7 days, 12 buys, BTCUSDT.

DCA Strategy Guidance

When helping users plan DCA:

1. Ask about budget — How much per buy, and how often?
2. Set expectations — DCA smooths volatility, not guaranteed profit
3. Run projections — Use plan to show scenarios before committing
4. Recommend testnet first — Set BINANCE_BASE_URL=https://testnet.binance.vision
5. Position sizing — Suggest 1-2% of portfolio per buy for conservative approach
6. Never store credentials — Always use environment variables

Scheduling DCA Buys

For automated recurring buys, suggest setting up a cron job or OpenClaw cron:

# Example: buy $50 BTC every Monday at 9am UTC
0 9 * * 1 BINANCE_API_KEY=... BINANCE_SECRET_KEY=... /path/to/dca.sh buy BTCUSDT 50

Or via OpenClaw cron for agent-managed scheduling with alerts and confirmations.

Error Handling

• Missing API keys → clear error message with setup instructions
• Invalid amounts → validation before API call
• API failures → descriptive error with endpoint info
• Always verify the order response status before confirming to user