Taco Connector

Interact with the Taco crypto trading platform via API. Use when the user wants to (1) get kline/candlestick market data, (2) check account balance and posit...

Security Scan

The skill appears to do what it claims (CLI client for the Taco trading API); required secrets are stored locally in a config file and no unexpected privileges or external installers are requested.

Purpose & Capability

Name/description align with the implementation: the script calls Taco API endpoints for klines, account/position queries, open/close/update position actions, and computes indicators locally. The config.json fields (user_id, api_token, trader_ids) are appropriate for a trading API client.

Instruction Scope

SKILL.md instructs the agent to detect Python, ensure the 'requests' package is present, run the included CLI, and create/read a config file at ~/.openclaw/workspace/taco/config.json. Those actions are within the scope of a CLI trading client. The instructions do direct writing a config file containing the API token (sensitive but expected for this purpose).

Install Mechanism

No install spec is provided (instruction-only). The only runtime installation recommended is pip install requests if missing — a proportionate, low-risk action.

Credentials

The skill requests no environment variables but requires storing an API token in a local config file, which is proportionate. Two small notes: (1) the BASE_URL in the script points to a 'dev' subdomain (https://api.dev.taco.trading) which may indicate a staging endpoint — verify that this is the intended production API before using with real funds; (2) the client includes the api_token both as a Bearer header and in the JSON body, which is redundant and increases exposure surface if the server logs bodies.

Persistence & Privilege

The skill does not request always:true, system-wide changes, or other skills' credentials. It writes a config file under the user's home workspace (expected for storing credentials) and otherwise runs as a normal CLI client.

Assessment

This skill is internally consistent with a trading API client, but you should: (1) review the code yourself or run it in a safe environment before using real funds; (2) verify the API endpoint (the script uses api.dev.taco.trading — confirm this is correct for your account); (3) protect the config file (store it with restrictive file permissions and do not commit it to source control); (4) consider using an API key with limited permissions and rotate it after testing; and (5) test trading actions on a sandbox/test account first to ensure no unexpected behavior.

Taco Trading Platform

Setup

Config is stored at ~/.openclaw/workspace/taco/config.json. Each exchange is bound to its own trader_id:

{
  "user_id": "<taco user id>",
  "api_token": "<taco api key>",
  "trader_ids": {
    "StandX": "<trader id for StandX>",
    "Binance": "<trader id for Binance>",
    "Hyper": "<trader id for Hyper>",
    "Lighter": "<trader id for Lighter>",
    "Aster": "<trader id for Aster>",
    "Grvt": "<trader id for Grvt>"
  }
}

Key concept: Exchange and trader_id are bound 1:1. When operating on a specific exchange, the CLI automatically uses the corresponding trader_id from config. Only configure the exchanges you use.

First-time setup: If config does not exist, ask the user for their user_id, api_token, and each exchange's trader_id, then write the JSON file to ~/.openclaw/workspace/taco/config.json (create parent directories as needed). Alternatively, run the interactive init command:

$PYTHON scripts/taco_client.py init

Before any API call: Check that ~/.openclaw/workspace/taco/config.json exists. If not, guide the user through setup first.

Python Requirement

Before running any command, detect the available Python 3 command:

command -v python3 || command -v python

• If python3 is found, use python3 (and pip3 for package installs)
• If only python is found, verify it is Python 3 with python --version. If it reports Python 2.x, treat it as unavailable.
• If neither provides Python 3, ask the user to install Python 3 before proceeding.

Then check the requests package: $PYTHON -c "import requests". If it fails, install with pip3 install requests (or pip install requests if only pip is available).

In all examples below, $PYTHON represents the detected Python command. Store the result once per session and reuse it for every subsequent call.

Usage

Run the CLI client at scripts/taco_client.py (relative to this skill directory). Requires the requests Python package. Config defaults to ~/.openclaw/workspace/taco/config.json (override with --config <path>).

Get kline data (no auth required)

$PYTHON scripts/taco_client.py kline \
  --symbol BTCUSDT --interval 1h --exchange Binance

Optional: --start-time <unix_ms> --end-time <unix_ms> (max 100 klines per response)

Valid intervals: 1m, 3m, 5m, 15m, 30m, 1h, 2h, 4h, 6h, 8h, 12h, 1d, 3d, 1w, 1M

Check account

$PYTHON scripts/taco_client.py account --exchange Binance

Returns: available_balance, total_equity, margin_used, and open positions for the specified exchange's trader.

Open position

$PYTHON scripts/taco_client.py open \
  --exchange Binance --symbol BTCUSDT --notional 100 --long --leverage 3 \
  --sl-price 80000 --tp-price 100000

• --long for long, omit for short
• --sl-price and --tp-price are optional
• --leverage defaults to 1.0

Close position

$PYTHON scripts/taco_client.py close \
  --exchange Binance --symbol BTCUSDT --notional 100 --long

• --long to close a long position, omit to close a short

Update take-profit / stop-loss

# Update take-profit price
$PYTHON scripts/taco_client.py update-tp-sl \
  --exchange Binance --symbol BTCUSDT --price 100000 --take-profit

# Update stop-loss price
$PYTHON scripts/taco_client.py update-tp-sl \
  --exchange Binance --symbol BTCUSDT --price 80000

• --take-profit to update take-profit price, omit to update stop-loss
• --price is the new trigger price

Calculate indicators (no auth required)

Fetches kline data and computes technical indicators locally. Supported types: EMA, MACD, RSI, ATR, BollingerBands, DonchianChannel.

# EMA (Exponential Moving Average)
$PYTHON scripts/taco_client.py indicator \
  --exchange Binance --symbol BTCUSDT --interval 1h --type EMA --period 20

# MACD (Moving Average Convergence Divergence)
$PYTHON scripts/taco_client.py indicator \
  --exchange Binance --symbol BTCUSDT --interval 1h --type MACD \
  --fast 12 --slow 26 --signal 9

# RSI (Relative Strength Index)
$PYTHON scripts/taco_client.py indicator \
  --exchange Binance --symbol BTCUSDT --interval 4h --type RSI --period 14

# ATR (Average True Range)
$PYTHON scripts/taco_client.py indicator \
  --exchange Binance --symbol BTCUSDT --interval 1d --type ATR --period 14

# Bollinger Bands
$PYTHON scripts/taco_client.py indicator \
  --exchange Binance --symbol BTCUSDT --interval 1h --type BollingerBands \
  --period 20 --std-dev 2.0

# Donchian Channel
$PYTHON scripts/taco_client.py indicator \
  --exchange Binance --symbol BTCUSDT --interval 1h --type DonchianChannel --period 20

Options:

• --type — required, one of: EMA, MACD, RSI, ATR, BollingerBands, DonchianChannel
• --period — indicator period (default varies by type: EMA=20, RSI=14, ATR=14, BollingerBands=20, DonchianChannel=20)
• --fast, --slow, --signal — MACD-specific (defaults: 12, 26, 9)
• --std-dev — BollingerBands standard deviation multiplier (default: 2.0)
• --limit N — show only the last N computed values (default: all)
• --start-time, --end-time — optional, same as kline

Supported exchanges

Binance, Hyper, Aster, Grvt, StandX, Lighter

API details

For full endpoint documentation and response schemas, see references/api-references.md.