Axodus Trading Integration

Integrate trading infrastructure (hummingbot/MCP) with paper-first mode and audit logs.

Security Scan

The skill is an instruction-only, paper-first trading integration checklist that is internally consistent with its stated purpose, but its metadata/source are vague and should be verified before use.

Purpose & Capability

The name/description (trading integration, paper-first, audit logs) matches the SKILL.md content: stepwise instructions for mapping connectors, risk gating, validation, and runbook outputs. No unexpected binaries, credentials, or system-level accesses are declared. Minor inconsistency: the packaging metadata and registry header show different owner/slug information (published registry record lists Axodus Trading Integration but files use 'trading-integration' and author 'RedHat Dev'); source/homepage is unknown. This is likely an administrative/packaging mismatch rather than functional incoherence, but it reduces provenance transparency.

Instruction Scope

SKILL.md is high-level guidance only: design steps, validations, safety rules, and expected outputs (integration summary, config contract, runbook). It does not instruct reading local system files, pulling secrets from the environment, invoking external URLs, or executing arbitrary shell commands. It does mention 'env/config references' and producing a 'config contract' (which is appropriate for an integration spec) but does not request or attempt to exfiltrate secrets.

Install Mechanism

No install spec and no code files — instruction-only. That is the lowest-risk install model since nothing is written or executed by the skill itself.

Credentials

The skill declares no required environment variables or credentials, and its guidance explicitly states not to store exchange API keys in plaintext and to keep live mode gated. It will likely produce a config contract listing what env vars an integrator must supply, which is expected. Users should verify that any env vars requested during implementation are limited to the trading integrations in scope and that secrets are stored securely (e.g., vaults, not plaintext).

Persistence & Privilege

The skill does not request persistent or privileged presence (always: false). It does not attempt to modify other skills or system-wide agent settings. Autonomous invocation is allowed by default (normal) but not a concern here given the instruction-only nature and lack of credentials.

Assessment

This skill is a high-level playbook for wiring hummingbot/MCP-style trading systems in paper-first mode and appears coherent and low-risk as an instruction-only document. Before installing or acting on it: (1) verify the skill's provenance — source/homepage and publisher metadata are missing/mismatched in the package, so prefer packages with clear origin; (2) when you implement the produced config contract, never paste live exchange keys into plaintext or repos — use a secrets manager; (3) confirm the runbook enforces explicit opt-in for live mode and preflight checks; (4) review any concrete code/config that someone implements from this guidance before running against live accounts; (5) if you need stronger assurance, ask the author for a repository link or signed release and inspect any code that will actually connect to exchanges.

SKILL: trading-integration

Purpose

Integrate trading infrastructure safely (hummingbot and/or MCP Axodus Trading) with paper-first execution, full logging/auditability, and strict risk gating.

When to Use

• Adding or updating connectors for hummingbot.
• Wiring execution to MCP Axodus Trading interfaces.
• Building market data ingestion, order routing, or strategy execution surfaces.

Inputs

• targets (required, string[]): e.g., ["hummingbot", "mcp-axodus-trading"]
• mode (optional, enum: paper|live, default: paper)
• markets (optional, string[]): symbols/venues to support.
• risk_limits (optional, object): max risk per trade, max drawdown, exposure caps, kill-switch.
• logging_requirements (optional, string[]): required audit events.

Steps

1. Confirm non-negotiables:
   • no profit guarantees
   • paper mode default
   • full logs for signal/decision/execution/result
2. Map integration points:
   • market data feeds
   • execution endpoints
   • capital allocation interface
3. Implement configuration surfaces:
   • env/config references (no secrets in repo)
   • explicit mode flag for live
4. Implement deterministic execution flow:
   • preflight checks (risk limits, connectivity)
   • order submission
   • order state tracking
   • post-trade recording
5. Implement failure handling:
   • bounded retries
   • fallback to safe stop
   • kill-switch triggers on abnormal loss
6. Validate in paper mode:
   • dry-run order lifecycle
   • audit logs produced
   • risk gating blocks unsafe actions

Validation

• Live mode cannot run without an explicit flag and passing preflight checks.
• All actions emit audit logs (no silent decisions).
• Risk limits are enforced before order placement.
• Secrets are not printed or committed.

Output

• Integration summary (what’s wired)
• Config contract (required env vars, mode flags)
• Validation commands/runbook (paper test loop)

Safety Rules

• Never enable live trading by default.
• Never request or store exchange API keys in plaintext.
• Never frame outcomes as guaranteed profit; treat as experimental systems with controlled risk.

Example

Paper-first integration:

• targets: ["hummingbot"]
• mode: paper
• Output: runbook describing simulated order placement and expected audit log entries.