Taco Connector

Interact with the Taco crypto trading platform via API. Use when the user wants to (1) get kline/candlestick market data, (2) check account balance and posit...

Security Scan

The skill and included CLI code are internally consistent with a Taco trading API client: it stores a local config, uses Python/requests to call api.taco.trade for market data and trading, and does not request unrelated credentials or install external code.

Purpose & Capability

Name/description match the code and SKILL.md: the script implements kline retrieval, account/position queries, open/close position endpoints, and local indicator calculations. Required data (user_id, api_token, trader_ids) are appropriate for a trading API client; no unrelated services or credentials are requested.

Instruction Scope

Instructions restrict actions to detecting Python, installing the requests package if missing, reading/writing the skill-specific config at ~/.openclaw/workspace/taco/config.json, and running the included Python CLI. The SKILL.md does not ask the agent to read unrelated system files or exfiltrate data to third-party endpoints beyond api.taco.trade.

Install Mechanism

There is no install spec (instruction-only) and the code is included in the skill bundle. The only runtime dependency is the well-known 'requests' Python package which the instructions install via pip if absent. No downloads from arbitrary URLs or archive extraction are present.

Credentials

No environment variables are requested. The skill persists sensitive credentials (api_token, user_id, trader_ids) in a local JSON config under the user's home directory; this is proportionate for a trading client but has privacy/security implications (see guidance). The client sends the api_token as a Bearer header and also includes it in POST bodies per the API docs—redundant but consistent with the included references.

Persistence & Privilege

always is false and the skill does not request elevated or system-wide privileges. It writes only to its own config path (~/.openclaw/workspace/taco/config.json), which is within the skill's scope.

Assessment

This skill appears to be a straightforward CLI client for the Taco trading API, but consider these before installing: - Source/ownership: the package homepage and source are missing and the owner id is unknown. If you do not trust the origin, review the full taco_client.py (including any truncated portions like the 'init' command) before running. - Sensitive data on disk: the API key (api_token), user_id, and trader_ids are stored in plaintext at ~/.openclaw/workspace/taco/config.json. Ensure file permissions restrict access (chmod 600) and avoid reusing high-privilege keys. - Network exposure: the script will transmit your api_token to https://api.taco.trade for authenticated operations. Only use an API key with limited scopes and with exchanges/accounts you trust. - Redundancy & review: the token is included both in the Authorization header and in request bodies—this is odd but documented in the references; inspect the code to confirm there are no other external endpoints or logging of secrets. - Operational safety: if you plan to use open/close position commands, test with a demo account or very small notional amounts first and ensure the trader_ids configured are correct. If you are comfortable with these risks and verify the code, the skill is coherent with its stated purpose. If you cannot verify the source, proceed with caution or avoid installing.

Taco Trading Platform

Setup

Config is stored at ~/.openclaw/workspace/taco/config.json. Each exchange is bound to its own trader_id:

{
  "user_id": "<taco user id>",
  "api_token": "<taco api key>",
  "trader_ids": {
    "StandX": "<trader id for StandX>",
    "Binance": "<trader id for Binance>",
    "Hyper": "<trader id for Hyper>",
    "Lighter": "<trader id for Lighter>",
    "Aster": "<trader id for Aster>",
    "Grvt": "<trader id for Grvt>"
  }
}

Key concept: Exchange and trader_id are bound 1:1. When operating on a specific exchange, the CLI automatically uses the corresponding trader_id from config. Only configure the exchanges you use.

First-time setup: If config does not exist, ask the user for their user_id, api_token, and each exchange's trader_id, then write the JSON file to ~/.openclaw/workspace/taco/config.json (create parent directories as needed). Alternatively, run the interactive init command:

$PYTHON scripts/taco_client.py init

Before any API call: Check that ~/.openclaw/workspace/taco/config.json exists. If not, guide the user through setup first.

Python Requirement

Before running any command, detect the available Python 3 command:

command -v python3 || command -v python

• If python3 is found, use python3 (and pip3 for package installs)
• If only python is found, verify it is Python 3 with python --version. If it reports Python 2.x, treat it as unavailable.
• If neither provides Python 3, ask the user to install Python 3 before proceeding.

Then check the requests package: $PYTHON -c "import requests". If it fails, install with pip3 install requests (or pip install requests if only pip is available).

In all examples below, $PYTHON represents the detected Python command. Store the result once per session and reuse it for every subsequent call.

Usage

Run the CLI client at scripts/taco_client.py (relative to this skill directory). Requires the requests Python package. Config defaults to ~/.openclaw/workspace/taco/config.json (override with --config <path>).

Get kline data (no auth required)

$PYTHON scripts/taco_client.py kline \
  --symbol BTCUSDT --interval 1h --exchange Binance

Optional: --start-time <unix_ms> --end-time <unix_ms> (max 100 klines per response)

Valid intervals: 1m, 3m, 5m, 15m, 30m, 1h, 2h, 4h, 6h, 8h, 12h, 1d, 3d, 1w, 1M

Check account

$PYTHON scripts/taco_client.py account --exchange Binance

Returns: available_balance, total_equity, margin_used, and open positions for the specified exchange's trader.

Open position

$PYTHON scripts/taco_client.py open \
  --exchange Binance --symbol BTCUSDT --notional 100 --long --leverage 3 \
  --sl-price 80000 --tp-price 100000

• --long for long, omit for short
• --sl-price and --tp-price are optional
• --leverage defaults to 1.0

Close position

$PYTHON scripts/taco_client.py close \
  --exchange Binance --symbol BTCUSDT --notional 100 --long

• --long to close a long position, omit to close a short

Calculate indicators (no auth required)

Fetches kline data and computes technical indicators locally. Supported types: EMA, MACD, RSI, ATR, BollingerBands, DonchianChannel.

# EMA (Exponential Moving Average)
$PYTHON scripts/taco_client.py indicator \
  --exchange Binance --symbol BTCUSDT --interval 1h --type EMA --period 20

# MACD (Moving Average Convergence Divergence)
$PYTHON scripts/taco_client.py indicator \
  --exchange Binance --symbol BTCUSDT --interval 1h --type MACD \
  --fast 12 --slow 26 --signal 9

# RSI (Relative Strength Index)
$PYTHON scripts/taco_client.py indicator \
  --exchange Binance --symbol BTCUSDT --interval 4h --type RSI --period 14

# ATR (Average True Range)
$PYTHON scripts/taco_client.py indicator \
  --exchange Binance --symbol BTCUSDT --interval 1d --type ATR --period 14

# Bollinger Bands
$PYTHON scripts/taco_client.py indicator \
  --exchange Binance --symbol BTCUSDT --interval 1h --type BollingerBands \
  --period 20 --std-dev 2.0

# Donchian Channel
$PYTHON scripts/taco_client.py indicator \
  --exchange Binance --symbol BTCUSDT --interval 1h --type DonchianChannel --period 20

Options:

• --type — required, one of: EMA, MACD, RSI, ATR, BollingerBands, DonchianChannel
• --period — indicator period (default varies by type: EMA=20, RSI=14, ATR=14, BollingerBands=20, DonchianChannel=20)
• --fast, --slow, --signal — MACD-specific (defaults: 12, 26, 9)
• --std-dev — BollingerBands standard deviation multiplier (default: 2.0)
• --limit N — show only the last N computed values (default: all)
• --start-time, --end-time — optional, same as kline

Supported exchanges

Binance, Hyper, Aster, Grvt, StandX, Lighter

API details

For full endpoint documentation and response schemas, see references/api-references.md.