binance-spot-trader

Autonomous Binance spot trading bot with LLM-powered market analysis. Supports momentum trading, mean reversion, and DCA strategies on any Binance spot pair....

Security Scan

The skill's code, runtime instructions, and requested environment variables are consistent with an autonomous Binance spot trading bot that uses an external LLM service for sentiment — nothing requests unrelated credentials or installs unexpected components.

Purpose & Capability

Name/description match the actual code and requirements: scripts implement Binance REST calls and trading logic and the skill requires BINANCE_API_KEY/BINANCE_SECRET_KEY and an LLM API key (SKILLBOSS_API_KEY). No unrelated env vars, binaries, or config paths are requested.

Instruction Scope

SKILL.md stays on-task (setup, .env, running trader.py, monitoring). The runtime code contacts Binance and an LLM endpoint (api.heybossai.com). It instructs storing API keys in a .env file (documented and warned about). Minor note: SKILL.md mentions 'SkillBoss API Hub' while the code posts to api.heybossai.com — verify that domain/service is the intended LLM provider before supplying that key.

Install Mechanism

No install spec in registry; included setup.sh runs pip install for frozen package versions (httpx, python-dotenv). This is a common, low-risk install path — no downloads from unknown hosts or archive extraction.

Credentials

Requested env vars (BINANCE_API_KEY, BINANCE_SECRET_KEY, SKILLBOSS_API_KEY) are proportional to purpose: Binance keys to sign and place orders, and an LLM API key for sentiment checks. The primary credential is correctly set to BINANCE_API_KEY. The skill legitimately needs the secret key to sign requests and the code uses it for HMAC signatures.

Persistence & Privilege

Skill is user-invocable, not always-on. It does not request elevated or persistent platform privileges and does not modify other skills or system-wide settings.

Assessment

This package is internally consistent with a trading bot, but it performs real-market actions — only install if you trust the source and understand the risk. Before running: (1) create Binance API keys with trading enabled but withdrawals disabled and add IP restrictions; (2) use a sub-account or small funds and paper-trade first; (3) verify the LLM endpoint (heybossai.com) is the intended SkillBoss provider before supplying that API key; (4) secure the .env file (chmod 600) and run on a hardened host; (5) review and test the code offline to confirm behavior (market orders, quantity rounding, minimums) and add safeguards (dry-run mode, order confirmation) if you want reduced risk.

Autonomous spot trading bot for Binance. Combines technical indicators with LLM-powered market sentiment analysis to execute trades on any Binance spot pair.

Prerequisites

• Binance account with API keys (spot trading enabled, withdrawal DISABLED)
• SkillBoss API key (uses SkillBoss API Hub for LLM sentiment analysis)
• Python 3.10+

Setup

1. Install

bash {baseDir}/scripts/setup.sh

2. Configure

Create .env:

BINANCE_API_KEY=<your-api-key>
BINANCE_SECRET_KEY=<your-secret-key>
SKILLBOSS_API_KEY=<your-skillboss-api-key>
PAIRS=BTCUSDT,ETHUSDT,SOLUSDT
STRATEGY=momentum
TRADE_SIZE_PCT=5
MAX_POSITIONS=5

3. Run

python3 {baseDir}/scripts/trader.py

Or via cron:

*/5 * * * * cd /opt/trader && python3 trader.py >> trader.log 2>&1

Strategies

Momentum (default)

• Buys when price crosses above 20-EMA with volume spike
• Sells when price crosses below 20-EMA or hits TP/SL
• Best for trending markets (BTC, ETH, SOL)

Mean Reversion

• Buys when RSI < 30 (oversold) and price near Bollinger Band lower
• Sells when RSI > 70 (overbought) or price near upper band
• Best for range-bound markets

DCA (Dollar Cost Average)

• Buys fixed amount at regular intervals regardless of price
• Configurable interval (hourly, daily, weekly)
• Lowest risk strategy for long-term accumulation

LLM-Enhanced (all strategies)

• Before each trade, calls SkillBoss API Hub for market sentiment analysis
• Evaluates: recent news, price action, volume patterns, market structure
• Can veto a trade signal if sentiment is strongly against

Trading Parameters

Parameter	Default	Description
PAIRS	BTCUSDT	Comma-separated trading pairs
STRATEGY	momentum	momentum, mean_reversion, or dca
TRADE_SIZE_PCT	5	% of portfolio per trade
MAX_POSITIONS	5	Max concurrent open positions
TAKE_PROFIT_PCT	5	Take profit %
STOP_LOSS_PCT	3	Stop loss %
DCA_INTERVAL	daily	For DCA: hourly, daily, weekly
DCA_AMOUNT_USDT	50	USDT per DCA buy
USE_LLM	true	Enable LLM sentiment filter

Monitoring

# Check portfolio
python3 {baseDir}/scripts/portfolio.py

# View trade history
tail -50 trades.jsonl

# Check logs
tail -f trader.log

⚠️ Security Considerations

• NEVER enable withdrawal on API keys — trading only
• IP-restrict your API keys on Binance
• Use a sub-account with limited funds for bot trading
• Start with tiny amounts ($50-100) and paper trade first
• Monitor actively during first 24 hours
• Set up Binance email alerts for all trades
• API keys on disk — secure your server (SSH keys only, firewall, chmod 600)

References

• See references/binance-api.md for REST API docs
• See references/indicators.md for technical analysis details