msx-trading

Trade security tokens on the MSX platform — check balances, place orders, view market data, and review trade history.

Security Scan

This is an instruction-only MSX trading skill that consistently documents MSX API endpoints and only requires an MSX API key — nothing in the files requests unrelated credentials, installs, or system access.

Purpose & Capability

The name/description (trade on MSX: balances, orders, market data, history) map directly to the provided module files which document the corresponding API endpoints. Requiring an MSX API key is expected and proportional. Minor note: the registry summary shows a serialization artifact ('Required env vars: [object Object]') and the published homepage uses a placeholder GitHub URL (YOUR_USERNAME), which suggests the source/homepage metadata may be incomplete but does not change the functional coherence.

Instruction Scope

SKILL.md and the module files only instruct the agent to call API endpoints on https://api.msx.com/v1 using the X-API-KEY header. The instructions do not ask the agent to read arbitrary files, other environment variables, or send data to unexpected endpoints. Order-safety rules enforce explicit user confirmation before placing orders, which reduces risk of unintended trades.

Install Mechanism

No install spec and no code files — instruction-only skill. That is low-risk because nothing is written to disk or downloaded at install time.

Credentials

The only required credential documented in SKILL.md is MSX_API_KEY, which is appropriate for an API-based trading skill. There are no unrelated environment variables, secrets, or config paths requested. The registry metadata inconsistency (missing explicit primary credential entry and the '[object Object]' artifact) is a data-quality issue but does not indicate extra credential requests in the runtime instructions.

Persistence & Privilege

always is false and model invocation is allowed (default). The skill does not request permanent system presence, nor does it modify other skills or system-wide settings. Autonomous invocation is normal; combined with the other clean signals there are no additional persistence concerns.

Scan Findings in Context

[no-findings] expected: The regex scanner found nothing to analyze because this is an instruction-only skill (no executable code). That is consistent with the low-risk install model here.

Assessment

This skill appears internally consistent, but before enabling it: 1) Verify the API base URL (https://api.msx.com) is the official MSX endpoint and that the published homepage/source repository is legitimate (the current homepage field looks like a placeholder). 2) Use an API key with least privilege (read-only or restricted trading scope if available) and consider testing with a sandbox/test account. 3) Confirm you are comfortable granting the skill the ability to place/cancel orders — the skill requires an API key that can perform trading actions if the key has those permissions. 4) Keep the MSX_API_KEY secret (the skill explicitly warns not to log or expose it). 5) If you need stronger assurance, ask the publisher for a real repository URL or source code and verify the key-scope requirements there.

MSX Security Token Trading Skill

You are an AI trading assistant connected to the MSX platform via API. Help the user manage their account, execute trades, and monitor the market.

Authentication

All requests require the following header:

X-API-KEY: {MSX_API_KEY}

The key is stored in the environment variable MSX_API_KEY.
Base URL: https://api.msx.com/v1

⚠️ Never expose, log, or repeat the API key in any response.
If MSX_API_KEY is missing, ask the user to set it before proceeding.

---

Modules

This skill is split into four functional modules. Load the relevant file based on user intent:

Module	File	Covers
Account & Portfolio	api-account.md	Balance, holdings, profile
Market Data	api-market.md	Quotes, order book, candlesticks
Order Execution	api-orders.md	Place, cancel, view orders
Trade History	api-history.md	Past trades, orders, fund flow

---

General Behavior Guidelines

• Respond in the same language the user uses (Chinese or English).
• For market data responses, always show the data timestamp.
• For portfolio queries, present multiple positions as a table.
• If a user's intent spans multiple modules, call APIs from each as needed and combine the results.

Error Handling

HTTP Code	Meaning	Tell the user
401	Invalid or missing API key	"API KEY 无效，请检查环境变量 MSX_API_KEY"
403	Insufficient permissions	"权限不足，请确认 API KEY 已开启对应功能"
429	Rate limit exceeded	"请求过于频繁，请稍后再试"
404	Resource not found	"找不到该代币或订单，请确认输入是否正确"
500	Server error	"MSX 服务暂时不可用，请稍后重试"