ccxt
v1.0.0Interact with 100+ cryptocurrency exchanges — fetch markets, order books, tickers, place orders, check balances, and more using the CCXT CLI.
⭐ 1· 1.1k·4 current·4 all-time
byPablo Criado-Perez@pcriadoperez
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the declared binary and install (node package ccxt-cli that provides a ccxt CLI). No unrelated binaries, env vars, or config paths are requested.
Instruction Scope
SKILL.md stays on-topic: it documents ccxt CLI usage for public and private endpoints, how to provide API keys (env vars or config file), and cautions about confirming orders. It does not instruct reading unrelated system files or exfiltrating data. Note: private methods will perform real account actions if API keys with trading/withdrawal permissions are set; the instructions appropriately recommend sandbox/testing and manual confirmation before createOrder, but users should still be cautious.
Install Mechanism
Install uses the npm package ccxt-cli (creates the 'ccxt' binary). This is a common/expected mechanism for a CLI, but npm packages are third-party artifacts — install writes files to disk and runs code from the package registry. Verify package provenance (publisher, npm page, checksums) if you plan to install automatically.
Credentials
The skill declares no required env vars. The documentation explains how to supply exchange API keys (per-exchange APIKEY/SECRET or a config file), which is proportionate and expected for trading operations. No unrelated secrets are requested.
Persistence & Privilege
always is false and model-invocation is allowed (platform default). The skill does not request system-wide persistence, nor does it modify other skills' configs. Autonomous invocation is normal but remember the skill can execute commands that may place trades if given keys.
Assessment
This skill appears coherent for using the ccxt CLI. Before installing or using it: (1) verify the npm package (ccxt-cli) publisher and review the package page/source if possible; (2) avoid storing high-privilege API keys in plain env variables or config files — create API keys with least privilege (e.g., trading but no withdrawals) and prefer testnet keys for experimentation; (3) prefer using --sandbox when testing and always confirm amounts/prices before createOrder; (4) consider installing the ccxt-cli yourself rather than allowing automated installs, and inspect the installed package if you have security concerns.Like a lobster shell, security has layers — review code before you run it.
latestvk976ej8htzsf50syjbkgz4537d81d0ct
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📊 Clawdis
Binsccxt
Install
Node
Bins: ccxt
npm i -g ccxt-cli