Vara Trading Skill

Local Spot Trading Skill

Execute local CLI commands for CEX spot trading and RivrDEX swaps on Vara Network. Keep CEX API keys in local config and keep DEX signing inside encrypted vara-wallet accounts.

The project does not run a backend. All commands execute locally on the user's machine.

Preamble

Run this check before using the skill:

if command -v vara-agent >/dev/null 2>&1; then
  echo "[PREFLIGHT] OK: vara-agent present ($(vara-agent --version 2>/dev/null || true))"
else
  echo "[PREFLIGHT] MISSING: vara-agent CLI is not on PATH."
  echo "[PREFLIGHT] Install: npm install -g vara-trading-skill"
  echo "[PREFLIGHT] Then restart the shell or agent session if PATH did not refresh."
fi

If vara-agent is missing, stop and ask the user for permission to install it. Do not ask for API keys in chat.

For a DEX request, also run:

if command -v vara-wallet >/dev/null 2>&1; then
  echo "[PREFLIGHT] OK: vara-wallet present ($(vara-wallet --version 2>/dev/null || true))"
else
  echo "[PREFLIGHT] MISSING: install vara-wallet >= 0.20.3"
fi

If vara-wallet is missing or older than 0.20.3, stop and ask before installing/upgrading it. Never ask for a seed, mnemonic, passphrase, or decrypted wallet export.

Supported Integration Types

• Active CEX trading: MEXC, Gate.io, Coinbase
• Active DEX trading: RivrDEX on Vara Network through vara-wallet
• Future CEX trading: Crypto.com
• Instant swap: Exolix, planned
• Fiat on-ramp: Banxa, planned
• Vara wallet: active for RivrDEX signing
• Route aggregator: basic route discovery implemented

Security Rules

• Never ask the user to paste API secrets into chat.
• Never display API keys or API secrets.
• Before any live trading setup, run the onboarding wizard.
• The user must pass steps: Welcome, Choose Exchange, Setup Instructions, Connect Credentials, Risk Limits, Validation, Dry-run, Final Confirmation, Ready.
• The user must explicitly choose MEXC, Gate.io, Coinbase, a custom comma-separated selection, or all active exchanges before live trading.
• When showing Custom selection, explain that it expects comma-separated exchange IDs, for example mexc,coinbase, gateio,coinbase, or mexc,gateio.
• API credentials must be stored locally in ~/.vara-trading-agent/.env.
• When reporting setup files to the user, show full paths such as ~/.vara-trading-agent/.env and ~/.vara-trading-agent/onboarding.json.
• If mentioning file mode 600, explain it as owner-only read/write permissions.
• Trading API keys must have read + trade permissions only.
• API withdrawals are available only as explicit opt-in high-risk actions.
• Withdrawal commands currently support MEXC and Gate.io. Coinbase is active for trading/read-only order workflows, not withdrawal automation.
• Live API withdrawals require dedicated withdrawal API keys, local allowlists, per-asset limits, --mode live, --address-confirmed, and --confirm-withdrawal.
• Dry-run mode must be preferred by default.
• Live trading requires explicit user instruction.
• Never infer a trade from analysis or discussion.
• Only execute a buy/sell command when the user explicitly asks to trade now.
• Canceling an order requires an explicit order id and confirmation.
• Never provide investment advice. Market data and order books are evidence, not instructions to trade.
• Read references/rivrdex-deployments.md for known deployment addresses. Verify any override; never guess a program address.
• Treat native VARA and WVARA as different assets. Before selling native VARA on RivrDEX, use the separate dex-wrap flow. It calls VftNativeExchange/Mint with attached native value using the bundled verified IDL.
• Convert WVARA back to native VARA only through the separate dex-unwrap transaction. It calls VftNativeExchange/BurnAll, so it always consumes the account's full WVARA balance. Let vara-wallet calculate gas by default; use --gas-limit only as an explicit fallback.
• Treat an explicitly confirmed native-VARA DEX trade as one disclosed staged workflow: wrap native input when needed, auto-approve and swap under the user's amount/slippage conditions, then unwrap WVARA output or residual WVARA back to native VARA. One user confirmation may authorize the complete non-atomic chain when every stage and the full BurnAll scope were disclosed in advance and the conditions do not change. Each state-changing vara-agent workflow command still carries its --confirm interlock. Read skills/dex_trade.md before executing any such workflow.
• Use dex-swap --mode dry-run first. Dry-run must call quote only and must not approve, sign, or submit.
• Require completed wallet_dex onboarding and --confirm for live DEX swaps.
• Bind live DEX execution to the onboarded network, factory, and local wallet account.
• On Vara mainnet, require at least 17 VARA native immediately before a swap. Before wrapping N VARA for the full native-input workflow, require at least N + 18 VARA. For the verified mainnet pair, use the typed Pair call with the reviewed 150-billion gas limit by default; it can reserve 15 VARA. Keep that limit exclusive to Pair swaps.
• Derive the USD risk value from the WUSDT/WUSDC side of a fresh DEX quote. A manual --estimated-value-usd may increase that value but must never lower or replace it. Require the manual option only when neither side is USD-like.
• Auto-approve is the default. For the verified mainnet pair, vara-agent must read the .address ActorId, clear any old allowance, approve and verify the exact quote-derived raw bound, execute the typed Pair call with 150-billion gas, and clear any remainder. --skip-approve is allowed only when the current allowance already equals that exact bound; cleanup remains mandatory.

Recipe Files

Read only the recipe needed for the user's request:

• skills/install_agent.md - install and connect this skill pack.
• skills/onboarding.md - first-time setup and exchange selection.
• skills/get_routes.md - discover CEX and RivrDEX routes for an asset/quote pair.
• skills/check_market.md - verify a market exists and inspect limits/precision.
• skills/get_balance.md - fetch account balances.
• skills/get_ticker.md - fetch ticker data.
• skills/get_orderbook.md - fetch order book depth.
• skills/trade_guidance.md - explain trade options, market-making style plans, risks, and dry-run next steps without giving investment advice.
• skills/get_open_orders.md - fetch active orders.
• skills/get_orders.md - fetch order history and status counts.
• skills/watch_orders.md - poll order history/open orders and report fills, cancellations, and status changes.
• skills/watch_order_until_done.md - after placing an order, track its returned order id and stop automatically when it reaches a terminal state.
• skills/cancel_order.md - cancel an explicit order id.
• skills/buy_spot.md, skills/sell_spot.md - market spot orders.
• skills/limit_buy_spot.md, skills/limit_sell_spot.md - limit spot orders.
• skills/withdrawal_guide.md, skills/withdrawal_check.md, skills/withdraw_asset.md - explicit withdrawal flow.
• skills/dex_onboarding.md - configure RivrDEX, vara-wallet, and DEX risk limits.
• skills/dex_pairs.md, skills/dex_pool.md, skills/dex_quote.md - read-only RivrDEX discovery.
• skills/dex_wrap.md - dry-run or explicitly confirmed conversion of native VARA to WVARA.
• skills/dex_unwrap.md - dry-run or explicitly confirmed conversion of the full WVARA balance to native VARA.
• skills/dex_trade.md - orchestrate wrap, exact auto-approval, the verified mainnet Pair call, allowance cleanup, and final unwrap for a user-facing native VARA trade.
• skills/dex_swap.md - dry-run or explicitly confirmed live RivrDEX swap.
• references/rivrdex-deployments.md - known RivrDEX factory and pair addresses; read it for mainnet DEX work.

CLI

Use:

vara-agent <command>

Agent-Led Interactive Setup

For first-time setup, prefer one continuous interactive session:

vara-agent init-config
vara-agent onboarding interactive

The agent should keep vara-agent onboarding interactive running, show the user the current prompt/options, accept the user's natural-language choice, and send the matching numeric answer to the CLI. Do not replace the interactive wizard with separate state commands such as onboarding choose-integration unless the user asks for non-interactive mode or the runtime cannot keep an interactive process open.

When the wizard is at Step 0 - Welcome / Risk Warning, show the full warning text before asking the user to continue:

This agent can analyze spot markets and execute trades on supported CEXs and RivrDEX after setup.

Crypto trading is risky. Start with dry-run or small amounts.

The wizard may pause at the credentials step because the user must create exchange API keys and edit ~/.vara-trading-agent/.env locally. After the user says the keys are saved, continue the wizard from the existing state with vara-agent onboarding interactive.

Onboarding validation must load markets and fetch balances for each selected CEX to test configured API credentials. Balance output should be presented as non-zero balances only, not raw CCXT account payloads.

For wallet_dex, validation must check vara-wallet >= 0.20.3, the selected local account, and connectivity to the verified RivrDEX factory. Do not display or handle wallet secrets.

Examples:

vara-agent onboarding interactive
vara-agent init-config
vara-agent install-skills
vara-agent onboarding
vara-agent onboarding understand
vara-agent onboarding choose-mode --mode cex_exchange
vara-agent onboarding choose-integration --integration mexc
vara-agent onboarding choose-integration --integration gateio
vara-agent onboarding choose-integration --integration coinbase
vara-agent onboarding choose-integration --integration mexc,coinbase
vara-agent onboarding choose-integration --integration gateio,coinbase
vara-agent onboarding choose-integration --integration all
vara-agent onboarding status
vara-agent routes --side buy --asset VARA --quote USDT --amount 20
vara-agent check-market --provider mexc --symbol VARA/USDT
vara-agent check-market --provider mexc --symbol USDC/USDT
vara-agent check-market --provider coinbase --symbol VARA/USD
vara-agent balance --provider mexc
vara-agent balance --provider coinbase
vara-agent ticker --provider mexc --symbol VARA/USDT
vara-agent ticker --provider coinbase --symbol VARA/USD
vara-agent orderbook --provider mexc --symbol VARA/USDT --limit 10
vara-agent open-orders --provider mexc
vara-agent orders --provider mexc
vara-agent watch --orders --provider mexc --symbols VARA/USDT --interval 5m --limit 50
vara-agent watch --orders --provider mexc --symbols VARA/USDT --order-id "<order-id>" --interval 30s --limit 50
vara-agent cancel-order --provider mexc --symbol VARA/USDT --order-id "<order-id>" --confirm
vara-agent withdrawal-guide --provider mexc --asset USDT --network TRC20 --amount 10 --address-confirmed
vara-agent withdrawal-check --provider mexc --asset USDT --network TRC20 --amount 10 --address "<address>"
vara-agent withdraw --provider mexc --asset USDT --network TRC20 --amount 10 --address "<address>" --mode dry-run
vara-agent buy --provider mexc --symbol VARA/USDT --quote-amount 10 --mode dry-run
vara-agent limit-buy --provider mexc --symbol VARA/USDT --quote-amount 2 --price 0.000605 --mode dry-run
vara-agent limit-sell --provider mexc --symbol VARA/USDT --base-amount 1000 --price 0.000604 --mode dry-run
vara-agent sell --provider mexc --symbol USDC/USDT --base-amount 10 --mode dry-run
vara-agent sell --provider mexc --symbol VARA/USDT --base-amount 100 --mode dry-run
vara-agent onboarding choose-mode --mode wallet_dex
vara-agent onboarding choose-integration --integration rivrdex
vara-agent dex-pairs --network mainnet
vara-agent dex-pool --token0 WUSDT --token1 WVARA --network mainnet
vara-agent dex-quote --token-in WUSDT --token-out WVARA --amount 10 --units human --network mainnet
vara-agent dex-wrap --amount 10 --units human --network mainnet --mode dry-run
vara-agent dex-unwrap --network mainnet --mode dry-run
vara-agent dex-swap --token-in WUSDT --token-out WVARA --amount 10 --units human --mode dry-run --network mainnet

Do not use live trading unless explicitly requested.

If the user says:

Buy VARA for 10 USDT

the agent may call dry-run first, or live only if the user explicitly requests live execution and the pair is allowed.

If the user says:

Swap 10 USDC to USDT on MEXC

the agent should treat it as a spot sell on USDC/USDT, preferably dry-run first.

If the user says:

Do you think I should buy VARA?

the agent must not call buy commands.

Onboarding

Before asking for any API key or wallet setup, use the wizard:

1. Welcome / Risk Warning
2. Choose mode: CEX exchange or RivrDEX wallet trading
3. Choose exchange/DEX and show integration-specific setup instructions
4. Connect credentials or configure a local encrypted wallet account
5. Configure risk limits
6. Validate setup
7. Dry-run
8. Final confirmation
9. Ready

Supported active first release exchanges:

• MEXC
• Gate.io
• Coinbase
• Any comma-separated exchange combination, for example mexc,coinbase, gateio,coinbase, or mexc,gateio
• All active exchanges
• RivrDEX on Vara Network through vara-wallet

Paper Trading, Exolix, Banxa, and Crypto.com are kept as future plans.

For RivrDEX:

1. Run vara-wallet wallet list; create/import a dedicated limited-balance account locally when needed.
2. Read references/rivrdex-deployments.md and verify the listed factory before live use.
3. Store only VARA_DEX_NETWORK, VARA_DEX_FACTORY, and VARA_DEX_ACCOUNT in ~/.vara-trading-agent/.env.
4. Configure WUSDT/WVARA and/or WVARA/WUSDT on mainnet. These are the tokenized aliases for the deployed VARA/USDT pair.
5. Explain that selling native VARA requires a separate dex-wrap transaction and that the pool returns WVARA when buying. Use dex-unwrap to return the full WVARA balance to native VARA. One confirmation may cover wrap, auto-approval, swap, allowance cleanup, and unwrap when the complete non-atomic chain and BurnAll scope are disclosed in advance; keep --confirm on every state-changing vara-agent workflow command. Use the bundled IDL; accept --idl only for an explicitly verified override.
6. Validate setup, then run vara-agent onboarding dry-run; it must automatically fetch the configured pool and a quote without selecting an account, approving, signing, or submitting.
7. Execute live only for an explicit user request using --mode live --confirm.

For CEX trading, explain that the user must:

1. Log in to the exchange.
2. Create a dedicated API key for this agent.
3. Grant only the minimum read and trade permissions needed by that exchange.
4. Store credentials locally in ~/.vara-trading-agent/.env.
5. Use separate withdrawal keys only if API withdrawal is explicitly enabled by the user.

The agent may create ~/.vara-trading-agent/.env and ~/.vara-trading-agent/onboarding.json during setup. These are user-home config files, not project-local files. Do not call them just .env without the path.

Gate.io-specific setup:

• Open Security and set a Fund Password first.
• It protects fund security.
• Trading does not require fund password input by default.
• Open API Key Management to create the Gate.io API key.
• Create a dedicated API key for this agent.
• Enable Read / View account data.
• Enable Spot Trading.
• IP whitelist is optional.
• Copy the API Key and Secret Key shown by Gate.io.
• Open ~/.vara-trading-agent/.env and fill these exact lines:

GATEIO_API_KEY=<paste Gate.io API Key here>
GATEIO_API_SECRET=<paste Gate.io Secret Key here>

• Secret Key may be shown only once; never paste it into chat.
• Withdrawal permission is not part of normal trading setup. API withdrawals are high risk; enable them only with a separate dedicated withdrawal key if the user explicitly wants withdrawal automation.

MEXC-specific setup:

• Click the account icon.
• Select API Management.
• Create a dedicated API key for this agent.
• Enable Account Details.
• Enable Trade.
• Enable View Order Details.
• Link IP Address is optional.
• Copy the API Key / Access Key and Secret Key shown by MEXC.
• Open ~/.vara-trading-agent/.env and fill these exact lines:

MEXC_API_KEY=<paste MEXC API Key / Access Key here>
MEXC_API_SECRET=<paste MEXC Secret Key here>

• Secret Key may be shown only once; never paste it into chat.

Coinbase-specific setup:

• Open Coinbase Developer Platform / Advanced Trade API key management.
• Create a dedicated API key for this agent.
• Scope the key to the portfolio this agent should trade from.
• Enable View.
• Enable Trade.
• Do not enable Transfer permissions for normal trading setup.
• IP whitelist is optional.
• Copy the API Key name and API Secret shown by Coinbase.
• Open ~/.vara-trading-agent/.env and fill these exact lines:

COINBASE_API_KEY=<paste Coinbase API Key name here>
COINBASE_API_SECRET=<paste Coinbase API Secret here>

• Secret may be shown only once; never paste it into chat.
• Coinbase withdrawal/transfer automation is not part of normal trading setup.
• Coinbase VARA note: VARA/USDC and VARA/USD are useful Coinbase market examples. VARA/USDT was not observed during testing; always run check-market before adding a Coinbase pair to live risk limits.

When pausing for the user to finish exchange setup, show the selected exchange field names such as MEXC_API_KEY, MEXC_API_SECRET, GATEIO_API_KEY, GATEIO_API_SECRET, COINBASE_API_KEY, and COINBASE_API_SECRET. Do not ask the user to paste key values into chat. Do not add old withdrawal-disabled wording to the MEXC or Gate.io setup checklist; withdrawal setup is a separate explicit opt-in flow.

If the user chooses multiple exchanges, show each full exchange-specific setup block before asking the user to confirm the checklist. Do not replace the exchange-specific instructions with a short generic checklist.

Recommend IP whitelist when a fixed IP is available, trading limits, a separate subaccount, and keeping only funds the user is willing to trade.

Risk limits must list every live-tradable pair explicitly, for example VARA/USDT,USDC/USDT on MEXC/Gate.io or VARA/USDC,VARA/USD on Coinbase. The agent must not place a live order for a pair outside the configured allowed pairs.

Order management commands:

vara-agent open-orders --provider mexc --symbols VARA/USDT,USDC/USDT --limit 50
vara-agent orders --provider mexc --symbols VARA/USDT,USDC/USDT --limit 50
vara-agent watch --orders --provider mexc --symbols VARA/USDT,USDC/USDT --interval 5m --limit 50
vara-agent watch --orders --provider mexc --symbols VARA/USDT --order-id "<order-id>" --interval 30s --limit 50
vara-agent cancel-order --provider mexc --symbol VARA/USDT --order-id "<order-id>" --confirm

When watching an order created by a trade command, read skills/watch_order_until_done.md and pass its returned exchange id as --order-id. The watcher stops automatically when that tracked order becomes closed, filled, canceled, cancelled, expired, or rejected. Use --keep-running only if the user explicitly asks to continue polling after the tracked order is finished.

Withdrawal guidance command:

vara-agent withdrawal-guide --provider mexc --asset USDT --network TRC20 --amount 10 --address-confirmed
vara-agent withdrawal-check --provider mexc --asset USDT --network TRC20 --amount 10 --address "<address>"
vara-agent withdraw --provider mexc --asset USDT --network TRC20 --amount 10 --address "<address>" --mode dry-run

Live withdrawal command:

vara-agent withdraw --provider mexc --asset USDT --network TRC20 --amount 10 --address "<address>" --mode live --address-confirmed --confirm-withdrawal

The agent may execute live API withdrawals only when the user explicitly asks for withdrawal now and the local config enables withdrawals with allowlisted assets, networks, addresses, and per-asset limits.

For future Exolix work, keep it separate from Exchange API trading. Explain that Exolix is an instant swap provider: create swap, receive deposit address, manually send funds, receive output, track status.