安全扫描
OpenClaw
安全
high confidenceThe skill's code, instructions, and required credentials are coherent with a Binance spot trading bot that uses an LLM for sentiment — there are no obvious unrelated permissions, unexpected installs, or hidden endpoints.
评估建议
This package appears to be what it says: an autonomous Binance spot trader that also calls an Anthropic LLM for sentiment. Before installing: (1) only use Binance API keys with trading enabled and withdrawals explicitly disabled; prefer a sub-account with limited funds; (2) secure the .env (chmod 600, limit server access) and IP-restrict the Binance key; (3) review and test the code locally in paper-trade mode or with tiny amounts first — the bot will place real market orders; (4) be aware that ...详细分析 ▾
✓ 用途与能力
Name/description (Binance spot trading with LLM sentiment) match what the files and SKILL.md request and implement: the scripts call Binance REST endpoints and an Anthropic LLM. Required env vars (BINANCE_API_KEY, BINANCE_SECRET_KEY, LLM_API_KEY) are appropriate for the stated purpose.
ℹ 指令范围
SKILL.md instructs installing dependencies, creating a .env with API keys, and running trader.py (or via cron). The code reads those env vars, writes a local trades.jsonl log, and sends market context to api.anthropic.com — all consistent with the described behavior. Note: the skill persists trade logs and will transmit summary market data to Anthropic (privacy/cost implications).
✓ 安装机制
setup.sh uses pip to install httpx and python-dotenv — reasonable, minimal, and from standard packaging. No downloads from unknown hosts or archive extraction are present.
✓ 凭证需求
Only three env vars are required (Binance API key + secret, LLM API key), which are proportionate to a trading bot that places orders and calls an LLM. No unrelated credentials or broad system paths are requested.
✓ 持久化与权限
Skill is not force-included (always:false) and does not request elevated platform privileges. It writes local logs (trades.jsonl, trader.log if run via cron) and does not modify other skills or system-wide settings.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/12
Initial release: autonomous Binance spot trading with momentum, mean reversion, and DCA strategies plus LLM sentiment analysis
● 无害
安装命令 点击复制
官方npx clawhub@latest install binance-spot-trader
镜像加速npx clawhub@latest install binance-spot-trader --registry https://cn.clawhub-mirror.com
技能文档
Autonomous spot trading bot for Binance. Combines technical indicators with LLM-powered market sentiment analysis to execute trades on any Binance spot pair.
Prerequisites
- Binance account with API keys (spot trading enabled, withdrawal DISABLED)
- Anthropic API key (uses Haiku ~$0.001/eval)
- Python 3.10+
Setup
1. Install
bash {baseDir}/scripts/setup.sh
2. Configure
Create .env:
BINANCE_API_KEY=
BINANCE_SECRET_KEY=
LLM_API_KEY=
PAIRS=BTCUSDT,ETHUSDT,SOLUSDT
STRATEGY=momentum
TRADE_SIZE_PCT=5
MAX_POSITIONS=5
3. Run
python3 {baseDir}/scripts/trader.py
Or via cron:
/5 * cd /opt/trader && python3 trader.py >> trader.log 2>&1
Strategies
Momentum (default)
- Buys when price crosses above 20-EMA with volume spike
- Sells when price crosses below 20-EMA or hits TP/SL
- Best for trending markets (BTC, ETH, SOL)
Mean Reversion
- Buys when RSI < 30 (oversold) and price near Bollinger Band lower
- Sells when RSI > 70 (overbought) or price near upper band
- Best for range-bound markets
DCA (Dollar Cost Average)
- Buys fixed amount at regular intervals regardless of price
- Configurable interval (hourly, daily, weekly)
- Lowest risk strategy for long-term accumulation
LLM-Enhanced (all strategies)
- Before each trade, asks Claude Haiku for market sentiment
- Evaluates: recent news, price action, volume patterns, market structure
- Can veto a trade signal if sentiment is strongly against
Trading Parameters
| Parameter | Default | Description |
|---|---|---|
PAIRS | BTCUSDT | Comma-separated trading pairs |
STRATEGY | momentum | momentum, mean_reversion, or dca |
TRADE_SIZE_PCT | 5 | % of portfolio per trade |
MAX_POSITIONS | 5 | Max concurrent open positions |
TAKE_PROFIT_PCT | 5 | Take profit % |
STOP_LOSS_PCT | 3 | Stop loss % |
DCA_INTERVAL | daily | For DCA: hourly, daily, weekly |
DCA_AMOUNT_USDT | 50 | USDT per DCA buy |
USE_LLM | true | Enable LLM sentiment filter |
Monitoring
# Check portfolio
python3 {baseDir}/scripts/portfolio.py# View trade history
tail -50 trades.jsonl
# Check logs
tail -f trader.log
⚠️ Security Considerations
- NEVER enable withdrawal on API keys — trading only
- IP-restrict your API keys on Binance
- Use a sub-account with limited funds for bot trading
- Start with tiny amounts ($50-100) and paper trade first
- Monitor actively during first 24 hours
- Set up Binance email alerts for all trades
- API keys on disk — secure your server (SSH keys only, firewall, chmod 600)
References
- See
references/binance-api.mdfor REST API docs - See
references/indicators.mdfor technical analysis details
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制