Mi Trading

Trade tokens on Solana using the ClawDex CLI. Use when the user asks to swap tokens, check balances, get quotes, or manage a Solana trading wallet.

Security Scan

The skill's instructions match a Solana trading tool (ClawDex) but the registry metadata omits the sensitive environment variables and wallet/config paths the SKILL.md requires — this mismatch and the need to access a local wallet make the package worth caution and further inspection.

Purpose & Capability

The name/description (Solana token trading via ClawDex) aligns with the SKILL.md content: commands, quotes, simulation, and execution are coherent for a trading skill. However, the registry metadata claims no required env vars or config paths while the instructions explicitly reference JUPITER_API_KEY, SOLANA_RPC_URL, and a wallet file (~/.config/solana/id.json), which is inconsistent and unexplained.

Instruction Scope

The SKILL.md stays within trading scope (health check, balances, simulate, execute) but it instructs the agent to access a local Solana wallet file and environment variables (JUPITER_API_KEY, optional SOLANA_RPC_URL). Accessing a user's wallet file is sensitive; the instructions do not limit which wallet to use or instruct using a dedicated/trust-limited wallet. The SKILL.md also suggests installing clawdex from npm, which requires running third-party code.

Install Mechanism

This is instruction-only (no install spec in registry). The SKILL.md recommends 'npm install -g clawdex@latest' if clawdex is not present — a common mechanism but it entails installing an npm package from the public registry. No opaque download URLs or extract steps are present in the skill itself.

Credentials

The registry declares no required env vars, but the SKILL.md requires JUPITER_API_KEY during onboarding and references SOLANA_RPC_URL. It also assumes access to a wallet file path (~/.config/solana/id.json). Requesting access to a private wallet file and an API key is proportionate to trading functionality — but it should be declared up front. The lack of declared credentials/config in metadata is a mismatch that could lead to unexpected exfiltration risk if the underlying clawdex binary is untrusted.

Persistence & Privilege

The skill does not request persistent/all-skill privileges (always: false) and does not modify other skills or system-wide settings in the provided instructions. Autonomous invocation is allowed by default (disable-model-invocation: false) but that is platform default and not by itself flagged.

What to consider before installing

This skill's instructions perform exactly the kind of operations you'd expect for a Solana trading CLI, but the registry metadata omits the sensitive items the SKILL.md needs (JUPITER_API_KEY, RPC URL, and a local wallet file). Before installing or running: (1) verify the provenance of the 'clawdex' npm package (publisher, repository, audit its source) rather than blindly running npm install -g; (2) never point the tool at your main wallet — use a dedicated wallet with minimal funds for testing; (3) consider running the CLI in an isolated environment/container; (4) confirm whether JUPITER_API_KEY or other secrets are actually required and where they are sent; (5) ask the skill author or registry to update metadata to declare required env vars and config paths. If the registry metadata and a trustworthy upstream repo are provided (and code audit shows no exfiltration), the concern would be reduced.

ClawDex — Solana DEX Trading Skill

Trade any Solana token through Jupiter aggregator with simulation, safety guardrails, and full JSON output.

Prerequisites

Before using this skill, ensure ClawDex is installed and configured:

which clawdex || npm install -g clawdex@latest

If not configured yet, run onboarding:

clawdex status --json

If status fails, set up with:

clawdex onboarding \
  --jupiter-api-key "$JUPITER_API_KEY" \
  --rpc "${SOLANA_RPC_URL:-https://api.mainnet-beta.solana.com}" \
  --wallet ~/.config/solana/id.json \
  --json

Commands

Check wallet balances

clawdex balances --json

Returns an array of { token, symbol, mint, balance, decimals } objects. Zero-balance accounts are included in JSON output.

Get a quote (no execution)

clawdex quote --in SOL --out USDC --amount 0.01 --json

Lightweight price check — no simulation, no wallet needed.

Simulate a swap (dry run)

clawdex swap --in SOL --out USDC --amount 0.01 --simulate-only --json

Runs full simulation on-chain without broadcasting. Does not require --yes. Use this to preview the output amount and route before committing.

Execute a swap

clawdex swap --in SOL --out USDC --amount 0.01 --yes --json

--yes is required for non-interactive execution. Without it, ClawDex exits with code 1.

Health check

clawdex status --json

Verify RPC connectivity, wallet validity, and config state.

Trading Workflow

Always follow this sequence:

1. Health check — clawdex status --json — abort if rpc.healthy is false
2. Check balances — clawdex balances --json — verify sufficient funds
3. Simulate — clawdex swap --simulate-only --json — preview the trade
4. Execute — clawdex swap --yes --json — only if simulation looks good
5. Verify — clawdex balances --json — confirm balances updated (may need 5s delay on public RPC)

Token Specification

Tokens can be passed by symbol or mint address:

• By symbol: SOL, USDC, USDT
• By mint: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v

Exit Codes

Code	Meaning	Agent action
0	Success	Continue
1	General error	Check message
2	Config error	Run onboarding
3	Safety violation	Reduce amount or adjust limits
4	Simulation failed	Try different pair/amount
5	Send failed	Retry with backoff

Safety

Set guardrails to prevent runaway trades:

clawdex safety set max_slippage_bps=300 max_trade_sol=1 max_price_impact_bps=100

When a guardrail triggers, the JSON response includes a violations array describing what failed.

Important Rules

• Always use --json for machine-parseable output
• Always use --yes for real swaps (not needed for --simulate-only)
• Never skip simulation unless you have a good reason — use --simulate-only first
• Parse balance as a string, not a number — it preserves full decimal precision
• Check exit codes — non-zero means the trade did not succeed
• Wait before verifying — RPC balance reads can lag a few seconds after a swap