starter-dashboard

starter-dashboard is a skill for Claude Code from alpacahq/alpaca-trade-api-js. It costs 75 tokens per session (742 once invoked), scanned A, original, Apache-2.0.

A scaffolding workflow for creating a local Next.js dashboard that demonstrates Alpaca paper trading and market-data APIs.

In plain words
What is it for?
Use it to generate a dashboard app, connect it to the published Alpaca TypeScript SDK, and start a local paper-trading or market-data prototype.
Why use it?
It gives a ready project structure for testing Alpaca integrations without configuring live trading, while leaving credentials for the developer to supply.

Skill for Claude Code

Written for Claude Code: user-invocable in frontmatter.

Good fit Use it to generate a dashboard app, connect it to the published Alpaca TypeScript SDK, and start a local paper-trading or market-data prototype.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/alpacahq/alpaca-trade-api-js/starter-dashboard
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add alpacahq/alpaca-trade-api-js --skill starter-dashboard
Clone the repo
git clone --depth 1 https://github.com/alpacahq/alpaca-trade-api-js

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for starter-dashboard

README.md
[![agentmods](https://agentmods.dev/badge/skills/alpacahq/alpaca-trade-api-js/starter-dashboard/github.svg)](https://agentmods.dev/skills/alpacahq/alpaca-trade-api-js/starter-dashboard)
Your own site
<a href="https://agentmods.dev/skills/alpacahq/alpaca-trade-api-js/starter-dashboard"><img src="https://agentmods.dev/badge/skills/alpacahq/alpaca-trade-api-js/starter-dashboard/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for starter-dashboard

Your own site · 80×15
<a href="https://agentmods.dev/skills/alpacahq/alpaca-trade-api-js/starter-dashboard"><img src="https://agentmods.dev/badge/skills/alpacahq/alpaca-trade-api-js/starter-dashboard.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 75 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 742 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 3 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium MCP Rug Pull · line 25
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 31
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 55
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00075 $0.00742
Opus 5 $0.00037 $0.00371
Sonnet 5 $0.00015 $0.00148
Haiku 4.5 $0.00007 $0.00074

Measured 12d ago against content hash 89bb9e9b5a77, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

starter-dashboard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

The scan reads SKILL.md. This mod also ships 7 executable files (scripts/scaffold.ts, template/app/trade/actions.ts, template/lib/alpaca.ts, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/starter-dashboard/SKILL.md · 80 lines

How it starts

The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Alpaca Starter Dashboard

Create a local Next.js dashboard for Alpaca paper trading and market data demos. The generated app uses the published @alpacahq/alpaca-trade-api package and calls the Trading API and Market Data API directly through the SDK.

Workflow

  1. Confirm the target directory and app name.
  2. Create the app locally with scripts/scaffold.ts.
  3. Default to paper trading (APCA_PAPER="true"). Do not configure live trading.
  4. Report the target path and give next commands. Do not print secrets from .env.local.

Run The Scaffolder

From this skill directory:

npx tsx scripts/scaffold.ts \
  --target-directory /path/to/my-alpaca-dashboard \
  --app-name my-alpaca-dashboard

If the local runtime supports it, node scripts/scaffold.ts or bun scripts/scaffold.ts are also acceptable. Prefer npx tsx for Node 20 compatibility.

The script reads these credential environment variables when flags are omitted:

  • APCA_API_KEY_ID
  • APCA_API_SECRET_KEY

If credentials are not locally available, pass --allow-placeholder-credentials; the generated .env.local will contain placeholders the user must fill before running the app.

Useful flags:

  • --create-subdirectory: treat --target-directory as the parent and create target/app-name.
  • --key-id / --secret: write explicit paper credentials without reading environment variables.
  • --paper: set the generated APCA_PAPER value. Defaults to true; keep this enabled for demos.

The target directory may already contain unrelated files. The scaffolder merges the template into the target, but refuses to overwrite any existing generated path, including .env.local.

Common failures:

  • TypeScript runner unavailable: use npx tsx, node with native TypeScript support, or bun.
  • Missing credentials: set APCA_API_KEY_ID and APCA_API_SECRET_KEY, pass --key-id / --secret, or use --allow-placeholder-credentials.
  • Invalid app name: use a lowercase npm package name with no spaces, uppercase letters, leading dot, or leading underscore.
  • Unsafe target: the target must not be a file or symlink, and generated paths must not already exist.

Read the full file on GitHub · 80 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 12d ago First seen · 80 lines · 75 tokens per session scan A 89bb9e9b5a77

Subscribe to this mod's changes

starter-dashboard is a skill published in the GitHub repository alpacahq/alpaca-trade-api-js (601 stars, last pushed today), licensed Apache-2.0. It adds 75 tokens to every session and 742 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

nfeio-node-sdk

NFE.io Node.js SDK integration expert (package: nfe-io). MUST trigger when: code imports 'nfe-io' or references NfeClient; user mentions NFE.io, NFS-e, NF-e, CT-e, CF-e, CFe-SAT, nota fiscal, nota fiscal eletronica, Brazilian invoice, fiscal document, electronic invoice Brazil, CNPJ lookup, CPF lookup, service…

nfe/client-nodejs · 264 tokens

alien-plugg-x402

38 paid x402 API endpoints for AI agents — Zora crypto analysis, Robinhood Chain tokenized stocks, on-chain intelligence, whale tracking, and utilities. MCP-compatible. Flat $0.003/call via USDC micropayments on Base.

michaelhutchings626-hub/alien-plugg-x402 · 57 tokens

3d-web-experience

Expert in building 3D experiences for the web - Three.js, React Three Fiber, Spline, WebGL, and interactive 3D scenes. Covers product configurators, 3D portfolios, immersive websites, and bringing dep.

ranbot-ai/awesome-skills · 53 tokens

angular-migration

Master AngularJS to Angular migration, including hybrid apps, component conversion, dependency injection changes, and routing migration.

ranbot-ai/awesome-skills · 26 tokens

crypto-signal-api

Real-time cryptocurrency trading signal generator. Analyzes 6 technical indicators (RSI, MACD, EMA, Bollinger Bands, Stochastic RSI, Volume) from Binance live data to produce BUY/SELL/HOLD signals with confidence scores. Available as REST API and MCP server.

lazymac2x/crypto-signal-api · 0 tokens

social-media-intelligence

Social media intelligence: financial signal extraction from Twitter/X, Telegram, Discord, and Reddit for sentiment-driven trading strategies.

HKUDS/Vibe-Trading · 28 tokens