A security proof-of-concept and BitoPro trading API wrapper designed to demonstrate supply-chain safety while providing tools for public ticker retrieval and private balance queries.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install bitopro-spot
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install bitopro-spot using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is BitoPro Spot Trading (Security PoC)?
The bitopro-spot skill serves a dual purpose: it acts as a functional API wrapper for the BitoPro cryptocurrency exchange and functions as an active security research Proof of Concept (PoC). Originally created to demonstrate namespace hijacking risks within the ecosystem, this skill highlights how easily unclaimed names can be registered by third parties.
From a technical perspective, the skill exposes endpoints to interact with BitoPro's spot market, which supports TWD (New Taiwan Dollar) fiat trading pairs. It highlights the security dynamics that developers must consider when installing third-party integrations via Openclaw Skills, emphasizing the absolute necessity of verifying publisher identity before providing sensitive API secrets.
BitoPro Spot Trading (Security PoC) Use Cases
- Security Audit & Awareness: Demonstrating how dependency confusion and unclaimed package slugs affect the AI tool ecosystem.
- Market Data Retrieval: Safely querying real-time ticker information and order book status without requiring authentication.
- Account Integration Testing: Simulating private account operations such as checking balances and validating environment variable scopes.
How BitoPro Spot Trading (Security PoC) Works
- Installation Audit: The user initializes the skill using the Openclaw Skills manager CLI.
- Environment Variable Configuration: For private endpoints, the skill prompts the user to supply critical credentials (API Key, Secret, Email) securely in the execution environment.
- Public API Calls: When get_tickers is invoked, the agent sends an unauthenticated GET request directly to BitoPro endpoints.
- Authenticated Queries: When private tools like get_account_balance are run, the system uses HMAC-SHA384 signatures built with the provided API secrets to verify user identity.
BitoPro Spot Trading (Security PoC) Setup
To integrate this skill for educational, security auditing, or development purposes within your Openclaw Skills workspace, execute the following steps:
- Install the Skill:
npx clawhub install bitopro-spot
- Configure Environment Variables: Set the following variables in your execution environment:
export BITOPRO_API_KEY="your_api_key"
export BITOPRO_API_SECRET="your_api_secret"
export BITOPRO_EMAIL="your_registered_email"
BitoPro Spot Trading (Security PoC) Data Schema & Taxonomy
The skill relies on specific environment configuration variables and exposes structured endpoints. Below is the metadata taxonomy used by this integration:
Environment Variables
| Variable | Required | Sensitive | Description |
|---|---|---|---|
BITOPRO_API_KEY |
Yes | Yes | API Key from the BitoPro dashboard used to authorize trading requests. |
BITOPRO_API_SECRET |
Yes | Yes | HMAC-SHA384 secret signature generator for secure private endpoints. |
BITOPRO_EMAIL |
Yes | No | The registered email associated with your BitoPro account acting as identity verification. |
Tool Definitions
- get_tickers: Fetches real-time ticker data. Parameters:
pair(optional string, e.g.,btc_twd). No authentication required. - get_account_balance: Retrieves the current balance for the configured BitoPro account. Requires full API authentication.
BitoPro Spot Trading (Security PoC) Advanced Features
- Dual-Scope API Design: Implements both unauthenticated public endpoints and signed private endpoints to test security boundary containment.
- HMAC-SHA384 Verification: Supports secure cryptographic signatures for private endpoints within Openclaw Skills integrations.
- Supply-Chain Risk Mitigation: Serves as a live reference architecture for auditing dependency confusion vulnerabilities in multi-agent orchestration systems.
SKILL.md
Loading
Related Openclaw Skills
EvoMind
EvoMind is a production-tested, zero-dependency Python framework offering a five-layer memory architecture and self-evolution capabilities for autonomous agents.
RealChinese
RealChinese is an open-source Chinese AI text humanization engine that detects 29 distinct AI footprints and rewrites content to match 8 major Chinese social media platforms.
Memfy
Memfy is a durable memory skill that allows AI agents to persist user-approved local context, project preferences, and workflow instructions safely.
Overseas Engineering BD
A domain knowledge capsule designed for East African engineering and photovoltaic market expansion, feeding structured workflows and intelligence directly into Universal Task OS.
Queenshow Detail Page Generator
A powerful AI agent skill designed to programmatically generate, update, and manage high-converting product detail pages through the Queenshow OpenAPI.
AI SEO Content Optimizer
An AI-powered SEO analysis and content optimization agent supporting multi-engine rankings, EEAT scoring, and structured data generation.
Featured*
