Apex

Trade and monitor ApeX perpetual futures. Check balances, view positions with P&L, place/cancel orders, execute market trades, or submit trade reward enrollm...

Security Scan

The skill mostly does what it says (ApeX trading) but the package/registry metadata omits the sensitive environment variables the code and SKILL.md require (including a private seed), and it will install many npm crypto/dependency packages — these mismatches and the need to supply a seed justify caution.

Purpose & Capability

The skill's name/description (ApeX trading & monitoring) matches the implemented functionality: the scripts call ApeX public and private APIs and implement balance, positions, orders and market analysis. That said, the registry metadata declared no required environment variables or primary credential even though the SKILL.md and code clearly require APEX_API_KEY, APEX_API_SECRET, APEX_API_PASSPHRASE and APEX_OMNI_SEED; this metadata omission is inconsistent and should be corrected before trust.

Instruction Scope

SKILL.md instructions are scoped to trading and monitoring: install node deps, run the provided scripts, set ApeX credentials, and confirm trades before execution. The instructions explicitly call out treating the Omni seed as a private key and advise local storage. They do instruct running npm install and passing credentials via env vars or .env which is expected for this use case.

Install Mechanism

There is no install spec in the registry (instruction-only), but the bundled scripts/package.json require running npm install which will pull several crypto and ethereum-related npm packages (apexomni-connector-node, @ethersproject libs, etc.). This is an expected but higher-risk install path than an instruction-only skill because it installs many dependencies from the public npm registry — verify package sources and consider sandboxed installation.

Credentials

The code and SKILL.md require highly sensitive credentials (APEX_API_KEY, APEX_API_SECRET, APEX_API_PASSPHRASE and especially APEX_OMNI_SEED — a seed/private-key equivalent). Those env vars are appropriate for on-exchange trading, but the registry metadata incorrectly lists none; the omission is dangerous because automated review or permission gating may not surface the need to supply a seed. No unrelated secrets are requested, but the presence of the Omni seed increases risk and requires careful handling (never upload to external agents or store on untrusted hosts).

Persistence & Privilege

The skill does not request always:true or elevated platform privileges. It writes a local trading-state.json file under the skill folder for state, which is reasonable for a CLI skill. It does not modify other skills or global agent config. The agent may invoke the skill autonomously by default (disable-model-invocation is false), which is normal; combine that with sensitive credentials only if you trust the runtime environment.

What to consider before installing

This skill implements real trading on ApeX and legitimately needs API credentials and an Omni seed to place orders — but the registry metadata incorrectly lists no required env vars. Before installing or running: 1) Do not supply your real Omni seed or API keys to untrusted/remote agents or cloud-hosted notebooks; prefer testnet (APEX_TESTNET=1) to validate. 2) Review the apexomni-connector-node package source and the package-lock to ensure dependencies are expected; note the connector version is an alpha release in package.json. 3) Run npm install in an isolated/sandboxed environment (or container) and verify network calls (calls go to api.coingecko.com and omni.apex.exchange). 4) If you intend to use this skill with real funds, correct the registry metadata to declare the required env vars and avoid passing seeds on shared/remote systems; consider creating restricted API keys with limited permissions where possible. 5) If you are uncomfortable providing an Omni seed, do not install or run the private operations; public market data and analysis scripts can be used without credentials.

ApeX Trading Skill

Full trading and portfolio management for ApeX perpetual futures exchange.

Prerequisites

Install dependencies once:

cd skills/apex/scripts && npm install

Authentication

Private operations require API credentials and an Omni seed:

• APEX_API_KEY
• APEX_API_SECRET
• APEX_API_PASSPHRASE
• APEX_OMNI_SEED

Important: APEX_OMNI_SEED is required by the SDK for order-related operations. Treat it like a private key/seed phrase and keep it strictly local. Do not share it or commit it.

Testnet:

• Set APEX_TESTNET=1 (or APEX_ENV=qa).

Core Operations

Market Data (Public)

Get price for a coin:

node scripts/apex.mjs price BTC

List available symbols:

node scripts/apex.mjs meta

Portfolio Monitoring (Private)

Check balance:

APEX_API_KEY=... APEX_API_SECRET=... APEX_API_PASSPHRASE=... APEX_OMNI_SEED=... \
  node scripts/apex.mjs balance

View positions with P&L:

APEX_API_KEY=... APEX_API_SECRET=... APEX_API_PASSPHRASE=... APEX_OMNI_SEED=... \
  node scripts/apex.mjs positions

Check open orders:

APEX_API_KEY=... APEX_API_SECRET=... APEX_API_PASSPHRASE=... APEX_OMNI_SEED=... \
  node scripts/apex.mjs orders

View trade history:

APEX_API_KEY=... APEX_API_SECRET=... APEX_API_PASSPHRASE=... APEX_OMNI_SEED=... \
  node scripts/apex.mjs fills

Trading Operations

All trading commands require the ApeX API credentials and seed.

Place limit orders:

APEX_API_KEY=... APEX_API_SECRET=... APEX_API_PASSPHRASE=... APEX_OMNI_SEED=... \
  node scripts/apex.mjs limit-buy BTC 0.1 45000

APEX_API_KEY=... APEX_API_SECRET=... APEX_API_PASSPHRASE=... APEX_OMNI_SEED=... \
  node scripts/apex.mjs limit-sell ETH 1 3000

Market orders:

APEX_API_KEY=... APEX_API_SECRET=... APEX_API_PASSPHRASE=... APEX_OMNI_SEED=... \
  node scripts/apex.mjs market-buy BTC 0.5

APEX_API_KEY=... APEX_API_SECRET=... APEX_API_PASSPHRASE=... APEX_OMNI_SEED=... \
  node scripts/apex.mjs market-sell ETH 2

Cancel orders:

APEX_API_KEY=... APEX_API_SECRET=... APEX_API_PASSPHRASE=... APEX_OMNI_SEED=... \
  node scripts/apex.mjs cancel-all

APEX_API_KEY=... APEX_API_SECRET=... APEX_API_PASSPHRASE=... APEX_OMNI_SEED=... \
  node scripts/apex.mjs cancel-all BTC

Submit trade reward enrollment:

APEX_API_KEY=... APEX_API_SECRET=... APEX_API_PASSPHRASE=... APEX_OMNI_SEED=... \
  node scripts/apex.mjs submit-reward 12345

Output Formatting

All commands output JSON. Parse and format for chat display:

For balance/portfolio:

• Show total equity and available balance
• List positions with size, entry price, unrealized P&L
• Summarize open orders

For trade execution:

• Confirm order details before executing
• Report order ID and status after execution
• Show filled price if immediately executed

Safety Guidelines

Before executing trades:

1. Confirm trade parameters with user (symbol, size, side, price)
2. Show current price and position for context
3. Calculate estimated cost/proceeds

Position sizing:

• Warn if trade is >20% of account equity
• Suggest appropriate sizes based on account balance

Price checks:

• For limit orders, compare limit price to current market price
• Warn if limit price is >5% away from market (likely mistake)

Error Handling

Common errors:

• "Missing APEX credentials" → Set API key, secret, passphrase, and seed
• "Unknown symbol" → Check available symbols with meta
• HTTP errors → Check network connection and API status

When errors occur:

• Show the error message to user
• Suggest fixes (set env vars, check symbol names, verify balance)
• Don't retry trades automatically

Trigger Phrases

Use submit-reward when the user expresses enrollment intent for OpenClaw activities or contests. If no reward ID is provided, default to 300001.

English examples:

• "Enroll me in the OpenClaw trading contest"
• "Register for OpenClaw activity"
• "Sign up for the OpenClaw contest"
• "Join the OpenClaw trading contest"

Chinese examples:

• "报名活动"
• "参加活动"
• "报名OpenClaw活动"
• "参加OpenClaw交易赛"

If the user provides a reward ID, use it. Otherwise use the default.

Workflow Examples

"How's my ApeX portfolio?"

1. Run balance to get total equity
2. Run positions to get open positions
3. Format summary: equity, positions with P&L, total unrealized P&L

"Buy 0.5 BTC on ApeX"

1. Run price BTC to get current price
2. Confirm with user: "Buy 0.5 BTC at market? Current price: $X. Estimated cost: $Y"
3. Execute market-buy BTC 0.5
4. Report result

"What's the current BTC price on ApeX?"

1. Run price BTC
2. Format response: "BTC: $X on ApeX"

"Close my ETH position"

1. Run positions to get current ETH position size
2. If long → market-sell, if short → market-buy
3. Execute with position size
4. Report result

"Enroll me in OpenClaw Trading Contest"

1. Run submit-reward (defaults to 300001)
2. Report result

Advanced Features

List all available symbols:

node scripts/apex.mjs meta

Notes

• Symbols use -USDT format for trading (e.g., BTC-USDT).
• Public market data endpoints often use BTCUSDT format.
• Prices are in USD.
• ApeX uses perpetual futures, not spot trading.
• Check references/api.md for API details.