MoneySharks

v1.0.2

Fully autonomous 24/7 Aster DEX perpetual futures trading agent. Manages the complete lifecycle — onboarding, live execution, bracket orders, trailing stop m...

0· 113·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The skill's name/description (autonomous Aster DEX futures trader) aligns with the files and runtime instructions. It only requests ASTER_API_KEY and ASTER_API_SECRET (primary credential ASTER_API_KEY), reads/writes local config/state/trades files, and contains code to call Aster API endpoints for account, orders, and market data. There are no unrelated credentials, binaries, or install steps that don't belong to a trading bot.
Instruction Scope
The SKILL.md and scripts consistently instruct the agent to validate credentials, write/validate config.json, run onboarding, and run the autonomous_runner.py loop (cron-driven) which reads market data, enforces risk checks, places bracket orders via the Aster API, and journals to local files. This is appropriate for the stated purpose. Notes: onboarding reads credentials from environment (or prompts) and verifies them via a readonly client; many scripts read/write config.json, state.json, and trades.json. The skill will register cron templates and instruct the platform to run the 24/7 loop; that is expected for continuous trading but is operationally high-impact, so users should be aware. There is no evidence in the provided files of data exfiltration to third-party endpoints beyond Aster API calls and local journaling.
Install Mechanism
No external install/download is required. This is an instruction-and-script bundle; install.sh performs local verification (Python version, syntax checks) and creates directories. No remote URLs, package downloads, or extracted archives were found in the manifest — lowest-risk install mechanism for this type of skill.
Credentials
Only ASTER_API_KEY and ASTER_API_SECRET are required, which is proportionate for a live trading agent. The SKILL.md and onboarding explicitly state secrets should live in environment variables and not be hardcoded. Users should, however, use API keys with minimal necessary permissions and consider IP/restriction settings on the exchange to limit risk.
Persistence & Privilege
always:false (not force-included). The skill is designed to register and enable cron jobs for continuous operation; onboarding will cause the agent to register cron job JSON automatically after the user consents. Autonomous execution (agent invoking skill code) is required for the skill's purpose and is present; the consent gate requires the user to physically type ACCEPT for autonomous_live. This background/cron capability is expected but operationally powerful — treat enabling as a deliberate action.
Assessment
This package appears to do exactly what it claims: autonomous trading on Aster DEX using your ASTER_API_KEY and ASTER_API_SECRET. Before installing or enabling live mode, consider these practical safeguards: - Test in paper mode first. The default/paper flows are supported; run paper for several days and review trades.json and logs before switching to live. - Use an exchange API key with the least privileges necessary. If possible, create a dedicated trading API key with explicit trade permissions and IP restrictions rather than using an account-wide key. Understand the key's permissions (withdrawals, margin changes, etc.) and remove anything not required. - Review and limit max_leverage, max_daily_loss, max_total_exposure in config.json to amounts you can afford to lose. The code enforces 'hard risk limits', but operational errors or exchange anomalies still carry risk. - Read onboarding and consent text carefully. The skill requires you to type ACCEPT to enable autonomous_live; the agent claims it cannot set autonomous_live_consent for you. Keep a copy of the consent and confirm the cron jobs that will be registered. - Audit the aster_readonly_client.py / live_execution_adapter.py files (present in the bundle) to verify which endpoints are used and how signatures are built. If you are not comfortable, run the code in a sandbox or inspect network calls with a sandboxed API key. - Ensure you have a documented and tested emergency halt procedure (scripts/halt.py exists). Test halting (in a safe environment) and verify the cron jobs/services can be disabled. - Keep this skill isolated from high-value accounts. Prefer a low-balance or dedicated trading account while you gain confidence. If you want, I can: summarize the specific files that perform live-orders and cron registration, highlight where the API key/secret are used in code, or list the exact cron jobs that will be registered and when they will run.

Like a lobster shell, security has layers — review code before you run it.

latestvk973eehh1qa24wq14zerpbkp4s833ekr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

EnvASTER_API_KEY, ASTER_API_SECRET
Primary envASTER_API_KEY

Comments