CCXT is a software library that gives programs a common interface for accessing cryptocurrency exchanges and prediction markets. It is used by developers, traders, analysts, and data scientists for market-data analysis, automated trading, backtesting, and trading bots.
Borrowing it
Nothing to install: this file belongs to ccxt/ccxt. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ccxt/ccxt/master/.agents/skills/onchain-pay-open-api/SKILL.mdgit clone --depth 1 https://github.com/ccxt/ccxtWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ccxt/ccxt/onchain-pay-open-api)<a href="https://agentmods.dev/skills/ccxt/ccxt/onchain-pay-open-api"><img src="https://agentmods.dev/badge/skills/ccxt/ccxt/onchain-pay-open-api/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ccxt/ccxt/onchain-pay-open-api"><img src="https://agentmods.dev/badge/skills/ccxt/ccxt/onchain-pay-open-api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 102 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high System Prompt Leakage · line 367 Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.Fix: Remove any instructions that reveal, print, or output system prompts or internal rules. System instructions should never be exposed to end users.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00193 | $0.04975 |
| Opus 5.5 | $0.00077 | $0.01990 |
| Sonnet 5.5 | $0.00039 | $0.00995 |
| Haiku 4.5 | $0.00019 | $0.00498 |
Grade C, and why
onchain-pay-open-api scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variableshighData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
### Step 1: Gather credentials Copies of this mod
1 near-identical copy found in the catalogue:
- onchain-pay-open-api — 98% identical, 20 lines differ
How it starts
The opening of the file, as written. The whole thing — 467 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Binance Onchain-Pay Open API Skill
Call Binance Onchain-Pay Open API endpoints with automatic RSA SHA256 request signing.
Use Cases & Scenarios
This skill is designed for the following scenarios:
1. 💳 Fiat-to-Crypto Purchase & Send
When to use: User wants to buy crypto with fiat currency and send directly to an external on-chain wallet address
- Buy USDT with USD/EUR/TWD using credit card → Send to MetaMask address on BSC
- Purchase BTC with Google Pay → Transfer to hardware wallet
- Buy USDC with P2P → Send to DeFi protocol contract address
Key APIs: trading-pairs → payment-method-list → estimated-quote → pre-order
2. 🔄 Direct Crypto Transfer (Send Primary)
When to use: User has crypto in Binance account and wants to send to external address
- Send existing USDT from Binance Spot to friend's wallet address
- Transfer ETH to Uniswap contract for trading
- Move crypto from Binance to self-custodial wallet (Trust Wallet, Ledger, etc.)
Key APIs: pre-order with SEND_PRIMARY customization
3. 🔗 Cross-Chain Bridge Operations
When to use: User needs to buy crypto on one chain and transfer to another network
- Buy USDC on Ethereum → Bridge to Polygon for lower fees
- Purchase tokens on BSC → Transfer to Base network
- Fiat to crypto on Solana → Send to Arbitrum for DeFi
Key APIs: crypto-network → pre-order with network selection
4. 🏪 Merchant Payment Integration
When to use: Integrate crypto payment gateway for e-commerce or services
- Accept fiat payments and auto-convert to crypto
- Enable "Pay with Crypto" checkout flow
- Process subscription payments with crypto
Key APIs: pre-order with externalOrderId tracking
5. 🤖 Smart Contract Interaction (Onchain-Pay Easy)
When to use: Buy crypto and execute smart contract in one transaction
- Buy USDT and deposit to lending protocol
- Purchase tokens and stake in DeFi pool
- Fiat on-ramp directly to GameFi or NFT marketplace
Key APIs: pre-order with ON_CHAIN_PROXY_MODE customization
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 467 lines · 193 tokens per session scan C ca7312670fd1
onchain-pay-open-api is a skill published in the GitHub repository ccxt/ccxt (44,604 stars, last pushed today), licensed MIT. It adds 193 tokens to every session and 4,975 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it C with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
market-sentiment
Synthesize crypto market sentiment by combining the Fear & Greed index, trending coins, narrative momentum, whale activity, and on-chain signals into a single actionable market read. Use when the user wants to know if the market is bullish, bearish, or transitioning. Powered by the free-crypto-news API.
coinank-openapi
Access CoinAnk crypto derivatives market data via API key or Agent Payments Protocol/x402 pay-per-call.
pump-swarm
Coordinated multi-wallet trading on Pump.fun.
trading-solana
Trade tokens on Solana DEXes - Jupiter, Raydium, Orca, Meteora, Pump.fun.
copy-trading
Automatically copy trades from successful wallets on Polymarket and crypto.
trading-evm
Trade tokens on EVM chains - Uniswap V3, 1inch on Ethereum, Arbitrum, Optimism, Base, Polygon.