Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

01-exchange-skill(not official)

v1.0.0

AI-powered 01.xyz exchange development skill for monitoring, trading strategies, and N1 blockchain integration. Covers REST API (FTX-inspired), Nord.ts SDK (@n1xyz/nord-ts), non-custodial trading patterns, and market making on Solana.

0· 1.6k·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for bouncyknighter/01-exchange-kill.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "01-exchange-skill(not official)" (bouncyknighter/01-exchange-kill) from ClawHub.
Skill page: https://clawhub.ai/bouncyknighter/01-exchange-kill
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install 01-exchange-kill

ClawHub CLI

Package manager switcher

npx clawhub@latest install 01-exchange-kill
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description claim an exchange dev/trading helper for 01.xyz and N1; the included docs and examples exclusively target market monitoring, SDK usage, local signing, and trading flows — this matches the stated purpose. Minor note: the metadata declares no required env vars or binaries even though the docs show using environment variables and installing SDKs/local API (see env/config examples).
Instruction Scope
SKILL.md and the included files stay within the advertised domain: public market fetches, account queries via local API, SDK usage, and extensive safety checks. The instructions explicitly forbid giving private keys to the AI and require human confirmation for trading, which limits scope creep. There are no instructions that request reading unrelated system files or exfiltrating arbitrary data.
Install Mechanism
This is an instruction-only skill (no install spec) which is low-risk. However the docs instruct users to run npm installs (e.g., @n1xyz/nord-ts, @n1xyz/local-api) and to run a local API — those are user-side actions not handled by the skill metadata. Because there is no declared install specification or verified homepage/source, users should validate the npm packages and their provenance before installing.
!
Credentials
Skill metadata declares no required environment variables, but the docs include environment-backed configuration examples (NORD_WEBSERVER, LOCAL_API_URL, SOLANA_RPC, NORD_APP_ID, etc.). This is an inconsistency: the runtime instructions reference env/config values the metadata doesn't declare. While the referenced variables are plausible for an SDK, the mismatch means the skill metadata understates what a user might need or set — verify what secrets/config are actually required and where they are stored.
Persistence & Privilege
The skill does not request always:true or other elevated persistence. There is no install-time code, no indication it writes to other skills' configs, and the default autonomous invocation flag is unchanged. Nothing in the files requests system-wide privileges.
What to consider before installing
This skill appears to be documentation and examples for building monitoring and trading tools against 01.xyz/N1 and is largely coherent with that purpose, but take these precautions before using it: - Provenance: the source and homepage are missing. Prefer official upstream sources (official docs.n1.xyz, npm org pages) or a known repository before installing anything. Ask the publisher for a link or commit history. - Verify packages: the docs recommend npm packages (@n1xyz/nord-ts, @n1xyz/local-api). Inspect those packages on the npm website (publisher, versions, weekly downloads, repository link) and prefer packages with source repos and checksums. - Environment mismatch: the skill metadata lists no env requirements, but the docs reference several env vars (NORD_WEBSERVER, LOCAL_API_URL, SOLANA_RPC, etc.). Don’t copy sensitive secrets into env variables unless you understand where they are used; never expose private keys or seed phrases to the agent or remote endpoints. - Local API safety: the workflow depends on a local signing API. Run it on a secure, isolated machine; prefer hardware wallets where supported; do not run a signing API on a public server or with keys that control large balances. - Testnet first: follow the docs’ advice—exhaustively test on devnet before mainnet with small funds and verify behavior. - If you need higher assurance: request the skill author to publish the repository/homepage, a release tarball, and checksums; ask for a short changelog and the npm package names used by the examples. If you can obtain an authoritative source (official repo or npm org) and confirm the referenced packages and env usage, the skill looks coherent and lower-risk. Without that provenance, treat it cautiously and avoid running installs or starting services suggested by the docs.

Like a lobster shell, security has layers — review code before you run it.

latestvk971td7c1w2xgwkkzwztagxsrh80hwa2
1.6kdownloads
0stars
1versions
Updated 2mo ago
v1.0.0
MIT-0

01.xyz Exchange Developer Skill

Non-custodial perpetual futures on Solana. Built by traders, for traders.

What this Skill is for

Use this Skill when the user asks for:

  • Market Monitoring: Orderbook depth, mark prices, funding rates, 24h stats
  • Account Tracking: Position monitoring, margin health, liquidation risk
  • Trading Strategies: Market making, DCA, grid trading, trend following
  • SDK Integration: Setting up Nord.ts (@n1xyz/nord-ts) for TypeScript/Python
  • API Development: Building on the FTX-inspired REST API
  • Risk Management: Position sizing, circuit breakers, margin calculations
  • N1 Protocol: Understanding the N1 blockchain and ZO protocol architecture

Overview

01.xyz is a non-custodial perpetual futures exchange built on the N1 blockchain (evolution of the ZO protocol). It enables fully self-custodied derivatives trading with up to 20x leverage on major crypto assets.

Key Design Principles

FeatureDescription
Non-custodialYour private keys never leave your machine. No central counterparty risk.
FTX-inspired APIFamiliar REST patterns for easy migration from centralized exchanges.
Local SigningUsers run a local API that signs transactions — funds remain under user control.
High PerformanceSub-second finality on N1 blockchain with Solana settlement.
Deep LiquidityProfessional market makers and tight spreads on major pairs.

Architecture Flow

┌─────────────────────────────────────────────────────────────┐
│                    User/Developer                           │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐      │
│  │   AI Agent   │  │  Local API   │  │   Browser    │      │
│  └──────┬───────┘  └──────┬───────┘  └──────┬───────┘      │
└─────────┼─────────────────┼─────────────────┼──────────────┘
          │                 │ (signed txs)    │
          │                 ▼                 │
          │        ┌──────────────┐           │
          │        │  N1 Network  │           │
          │        │  (L2 chain)  │           │
          │        └──────┬───────┘           │
          │               │                   │
          │    ┌──────────▼──────────┐        │
          └────►  zo-mainnet.n1.xyz  ◄────────┘
               │    REST/WebSocket    │
               └──────────┬───────────┘
                          │
               ┌──────────▼──────────┐
               │   Solana L1         │
               │   (settlement)      │
               └─────────────────────┘

Network Endpoints

NetworkBase URLPurposeStatus
Mainnethttps://zo-mainnet.n1.xyzLive trading, real fundsProduction
Devnethttps://zo-devnet.n1.xyzTesting, dev workDevelopment

Default Stack Decisions

These are opinionated defaults. Adjust for your specific use case.

1. Data Access Pattern

Use CaseRecommended ApproachAuth Required
Market data (prices, orderbook)Direct HTTP to public endpoints❌ No
Account data (positions, balances)Local API or Nord SDK✅ Yes
Order placementLocal API with user confirmation✅ Yes

2. SDK Selection

LanguagePackageUse When
TypeScript@n1xyz/nord-tsFull-featured trading, complex strategies
Pythonn1-sdk (pip)Quant research, ML models, backtesting
Raw HTTPDirect REST callsSimple monitoring, language-agnostic

3. Security Model

  • AI only reads public data — Never expose private keys to AI systems
  • Local signing mandatory — All transactions signed by user's local instance
  • Explicit confirmation — Trading actions require human approval
  • Testnet first — Always validate on devnet before mainnet

4. Development Priority

  1. Read-only monitoring ✅ — Start here, safe for all users
  2. Account health tracking ✅ — Requires wallet address only
  3. Paper trading simulation ⚠️ — Test strategies without real funds
  4. Live trading ⚠️ — Requires local API + explicit user consent

Operating Procedure

When working with 01.xyz integration:

Phase 1: Discovery

  1. Identify the task type:

    • MONITORING — Market data, public stats
    • ACCOUNT — Position/balance queries
    • TRADING — Order placement, strategy execution
    • RISK — Health checks, liquidation analysis
  2. Determine authentication needs:

    • Public endpoints: No auth needed
    • Account data: Wallet address sufficient
    • Trading: Local API with signing required

Phase 2: Data Collection

  1. For market data:

    // Direct HTTP — no auth required
    const markets = await fetch('https://zo-mainnet.n1.xyz/info').json();
    
  2. For account data:

    // Via local API or SDK
    const account = await nord.getAccount(walletAddress);
    

Phase 3: Safety Validation

  1. Before any trading action:
    • ☐ Verify account health (margin fraction > 10%)
    • ☐ Check open orders for conflicts
    • ☐ Calculate position impact on margin
    • ☐ Confirm funding rate direction
    • ☐ Get explicit user confirmation

Phase 4: Execution

  1. Execute with monitoring:
    • Submit order via local API
    • Track fill status
    • Update position state
    • Log all actions

Progressive Disclosure

Read these files when the topic comes up:

FileRead WhenSafety Level
safety-first.mdFIRST — before anything else⚠️ Mandatory
monitoring-guide.mdGetting market data, checking prices✅ Safe
risk-management.mdManaging leverage, liquidation risk✅ Read-only
trading-basics.mdUnderstanding order types, markets⚠️ Gated
sdk-reference.mdSetting up Nord.ts SDK✅ Documentation
README.mdProject overview, installation✅ General

Examples Directory

Working code samples in examples/:

Quick Reference

Market IDs Reference

01.xyz uses numeric market IDs (not symbols):

IDMarketMax LeverageTick Size
0BTCUSD20x$0.50
1ETHUSD20x$0.10
2SOLUSD20x$0.01
3HYPEUSD10x$0.01
...See /info endpoint

HTTP Endpoints

Public (no auth):

GET /info                    # All markets
GET /market/{id}/orderbook   # L2 orderbook
GET /market/{id}/stats       # 24h stats, funding
GET /trades                  # Recent trades

Private (requires local API):

GET /account/{address}       # Positions, balances
POST /action                 # Submit orders

Common SDK Operations

import { Nord } from '@n1xyz/nord-ts';

// Initialize
const nord = await Nord.new({
  app: 'zoau54n5U24GHNKqyoziVaVxgsiQYnPMx33fKmLLCT5',
  solanaConnection: connection,
  webServerUrl: 'https://zo-mainnet.n1.xyz',
});

// Get markets
const markets = await nord.getMarkets();

// Get orderbook
const orderbook = await nord.getOrderbook(2); // SOLUSD

// Place order (requires auth)
const order = await nord.placeOrder({
  marketId: 2,
  side: 'buy',
  size: 1.0,
  price: 150.00,
  orderType: 'limit',
});

Safety & Risk Checklist

Pre-Trading Checklist

Read safety-first.md — Non-custodial reality check
Verify on devnet first — Test all logic with fake funds
Check account health — Margin fraction > 10% (ideally > 20%)
Review funding rates — Can flip PnL significantly
Calculate liquidation price — Know your liquidation level
Set stop-losses — Use trigger orders for downside protection
Confirm market ID — Numeric IDs, not symbols

In-Flight Monitoring

Monitor margin fraction — Alert if < 15%
Track funding payments — Every 8 hours
Watch for liquidations — Cascading effects in volatile markets
Log all operations — Audit trail for debugging

Emergency Procedures

  • Approaching liquidation: Reduce position size immediately or add collateral
  • API unresponsive: Check local API status, verify network connectivity
  • Unexpected fills: Review order history, check for stale orders
  • Wrong market ID: Cancel all pending orders, verify symbol mapping

Resources

Official Documentation

SDKs & Tools

Community

  • Discord: N1 Exchange Community
  • Twitter/X: @01_exchange

Updates

  • Version: 1.0.0
  • Last Updated: 2026-02-04
  • API Version: 2026-01
  • Compatibility: N1 Mainnet, Devnet

This Skill follows the OpenClaw Skill Specification. For more information on creating Skills, see the Skill documentation.

Comments

Loading comments...