Ccxt Crypto Api

CCXT 库统一封装全球主流加密货币交易所的交易 API，支持订单管理、市场行情查询、账户余额监控与自动化借贷等核心操作。

Security Scan

The skill claims to be a CCXT-based crypto trading wrapper but its instructions and reference artifacts mix in ZVT/A-share backtesting dependencies and runtime checks while failing to declare exchange credentials—this mismatch is incoherent and deserves caution before use.

Purpose & Capability

The name/description advertise a CCXT crypto-trading API, including placing orders and monitoring balances. However the SKILL.md and reference files repeatedly mention ZVT (an A-share/backtesting toolkit), A-share use-cases, and preconditions that import and test zvt. The skill does not declare required exchange API keys or credentials even though many listed use cases perform authenticated trading. These items do not align: a pure CCXT trading helper would normally declare or request API key secrets and not require zvt for basic exchange operations.

Instruction Scope

Runtime instructions force reads of local artifacts (seed.yaml) and list preconditions that run python -c checks to import zvt, verify zvt version, ensure ZVT_HOME exists, and attempt to write a test file in that directory. The execution_protocol in seed.yaml also instructs running install recipes and reloading seed.yaml before any behavioral decision. Those checks operate on the agent host environment and may trigger package installs or filesystem writes; they are broader than what a simple CCXT wrapper should need. The SKILL.md also instructs the agent to enforce many domain locks (fatal constraints) which broaden runtime behavior.

Install Mechanism

There is no declared install spec (instruction-only), which is low risk. However the SKILL.md/seed.yaml assume a Python 3.12+ environment and reference running pip installs and host install_recipes. The absence of a formal install step but presence of procedural install instructions is an inconsistency—the agent may attempt to run package installs at runtime despite no install manifest being provided.

Credentials

The skill declares no required environment variables or primary credentials, yet its stated capabilities include authenticated exchange operations (orders, account monitoring) that normally require API keys and secrets. The SKILL.md references ZVT_HOME and preconditions check that env var; this env var is not declared in requires.env. The mismatch—no declared API credentials but expectation of exchange operations and local environment checks—indicates disproportionate or undocumented environment access.

Persistence & Privilege

always is false and the skill does not request permanent platform-level privileges. There is no evidence it modifies other skills' configurations. The main risk is procedural: the skill's runtime instructions may run package installs or write to ZVT_HOME, but that is scoped to host actions and not a persistent privilege flag in the registry.

What to consider before installing

This skill is internally inconsistent and should be reviewed before use. Specific things to consider: - Clarify purpose with the author: is this a CCXT exchange wrapper or a ZVT-driven backtest pipeline? The SKILL.md mixes both. - Do NOT run this against real exchange accounts until you verify where and how API keys are used. The skill lists trading use cases but does not declare or document required API_KEY/TOKEN variables—if you provide keys, scope them to read-only or limited test accounts and use exchange sandbox environments. - The runtime instructions run Python commands that check/import zvt, validate ZVT_HOME, and may instruct package installs or create files. Run in an isolated environment (container or VM) first, and inspect seed.yaml and references/ files offline to confirm behavior. - If you plan to run authenticated operations, request explicit documentation of required credentials and how they are used; prefer ephemeral or least-privilege keys. - If you want this skill for only CCXT-based exchange interactions, ask the maintainer to remove unrelated ZVT preconditions and to explicitly declare required env vars (API keys) and any install steps. What would change this assessment: confirmation from the publisher that the reference ZVT checks are incidental (e.g., artifact from blueprint compilation) and will be removed, or an updated SKILL.md that explicitly declares required exchange credentials and a minimal, consistent set of preconditions. If such clarifications are provided, confidence could move to benign. Without that, the mixing of domains and undocumented environment access makes this suspicious.

CCXT 加密交易接口 (ccxt-crypto-api)

CCXT 库统一封装全球主流加密货币交易所的交易 API，支持订单管理、市场行情查询、账户余额监控与自动化借贷等核心操作。

Pipeline

data_collection -> data_storage -> factor_computation -> target_selection -> trading_execution -> visualization

Top Use Cases (100 total)

Bitfinex fUST Lending Bot (UC-101)

Automates cryptocurrency lending on Bitfinex by checking for lending opportunities and executing market orders to deploy funds into lending markets Triggers: lending, bot, bitfinex

Cross-Exchange Spot Arbitrage Bot (UC-102)

Scans multiple exchanges (OKX, Bybit, Binance, KuCoin, BitMart, Gate.io) for price discrepancies in spot markets and executes arbitrage trades Triggers: arbitrage, spot trading, cross-exchange

Binance Create and Cancel Order (UC-103)

Demonstrates creating a limit order on Binance and then canceling it, useful for testing order workflows Triggers: create order, cancel order, binance

For all 100 use cases, see references/USE_CASES.md.

Execute trigger: When user intent matches intent_router.uc_entries[].positive_terms AND user uses action verb (run/execute/跑/执行/backtest/fetch/collect)

What I'll Ask You

• Target market: A-share (default), HK, or crypto? (US stocks in ZVT are half-baked — stockus_nasdaq_AAPL exists but coverage is thin)
• Data source / provider: eastmoney (free, no account), joinquant (account+paid), baostock (free, good history), akshare, or qmt (broker)?
• Strategy type: MACD golden-cross, MA crossover, volume breakout, fundamental screen, or custom factor?
• Time range: start_timestamp and end_timestamp for backtest period
• Target entity IDs: specific stocks (stock_sh_600000) or index components (SZ1000)?

Semantic Locks (Fatal)

ID	Rule	On Violation
SL-01	Execute sell orders before buy orders in every trading cycle	halt
SL-02	Trading signals MUST use next-bar execution (no look-ahead)	halt
SL-03	Entity IDs MUST follow format entity_type_exchange_code	halt
SL-04	DataFrame index MUST be MultiIndex (entity_id, timestamp)	halt
SL-05	TradingSignal MUST have EXACTLY ONE of: position_pct, order_money, order_amount	halt
SL-06	filter_result column semantics: True=BUY, False=SELL, None/NaN=NO ACTION	halt
SL-07	Transformer MUST run BEFORE Accumulator in factor pipeline	halt
SL-08	MACD parameters locked: fast=12, slow=26, signal=9	halt

Full lock definitions: references/LOCKS.md

Top Anti-Patterns (13 total)

• AP-CRYPTO-TRADING-001: Float Arithmetic for Monetary Values
• AP-CRYPTO-TRADING-002: Missing Market Initialization Before Access
• AP-CRYPTO-TRADING-003: Bypassing API Facade Layer

All 13 anti-patterns: references/ANTI_PATTERNS.md

Evidence Quality Notice

[QUALITY NOTICE] This crystal was compiled from blueprint finance-bp-111. Evidence verify ratio = 60.5% and audit fail total = 9. Generated results may have uncaptured requirement gaps. Verify critical decisions against source files (LATEST.yaml / LATEST.jsonl).

Reference Files

File	Contents	When to Load
references/seed.yaml	V6+ 全量权威 (source-of-truth)	有行为/决策争议时必读
references/ANTI_PATTERNS.md	13 条跨项目反模式	开始实现前
references/WISDOM.md	跨项目精华借鉴	架构决策时
references/CONSTRAINTS.md	domain + fatal 约束	规则冲突时
references/USE_CASES.md	全量 KUC-* 业务场景	需要完整示例时
references/LOCKS.md	SL-* + preconditions + hints	生成回测/交易代码前
references/COMPONENTS.md	AST 组件地图（按 module 拆分）	查 API 时

---

Compiled by Doramagic crystal-compilation-v6.1 from finance-bp-111 blueprint at 2026-04-22T13:00:53.651332+00:00. See human_summary.md for non-technical overview.