# Vara Trading Skill > Use when an agent needs to set up or operate the local vara-agent CLI for spot trading: CEX markets and explicit orders on MEXC, Gate.io, or Coinbase; native VARA wrapping/unwrapping plus RivrDEX pool discovery, quotes, and explicit dry-run/live swaps on Vara through vara-wallet; order management; and explicitly confirmed withdrawals. Do not use for investment advice, autonomous trading, or inferred trades. - Skill: `gear-foundation/vara-trading-skill` (Agent Skill, multi-file: 33 files) - Install (CLI): `npx skillmds@latest add gear-foundation/vara-trading-skill` - Raw SKILL.md: https://api.skillmd.com/api/skills/gear-foundation/vara-trading-skill/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Product & Planning - License: MIT - Author: gear-foundation (https://skillmd.com/u/gear-foundation) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/gear-foundation/vara-trading-skill --- # Local Spot Trading Skill Execute local CLI commands for CEX spot trading and RivrDEX swaps on Vara Network. Keep CEX API keys in local config and keep DEX signing inside encrypted `vara-wallet` accounts. The project does not run a backend. All commands execute locally on the user's machine. ## Preamble Run this check before using the skill: ```bash if command -v vara-agent >/dev/null 2>&1; then echo "[PREFLIGHT] OK: vara-agent present ($(vara-agent --version 2>/dev/null || true))" else echo "[PREFLIGHT] MISSING: vara-agent CLI is not on PATH." echo "[PREFLIGHT] Install: npm install -g vara-trading-skill" echo "[PREFLIGHT] Then restart the shell or agent session if PATH did not refresh." fi ``` If `vara-agent` is missing, stop and ask the user for permission to install it. Do not ask for API keys in chat. For a DEX request, also run: ```bash if command -v vara-wallet >/dev/null 2>&1; then echo "[PREFLIGHT] OK: vara-wallet present ($(vara-wallet --version 2>/dev/null || true))" else echo "[PREFLIGHT] MISSING: install vara-wallet >= 0.20.3" fi ``` If `vara-wallet` is missing or older than `0.20.3`, stop and ask before installing/upgrading it. Never ask for a seed, mnemonic, passphrase, or decrypted wallet export. ## Supported Integration Types - Active CEX trading: MEXC, Gate.io, Coinbase - Active DEX trading: RivrDEX on Vara Network through `vara-wallet` - Future CEX trading: Crypto.com - Instant swap: Exolix, planned - Fiat on-ramp: Banxa, planned - Vara wallet: active for RivrDEX signing - Route aggregator: basic route discovery implemented ## Security Rules - Never ask the user to paste API secrets into chat. - Never display API keys or API secrets. - Before any live trading setup, run the onboarding wizard. - The user must pass steps: Welcome, Choose Exchange, Setup Instructions, Connect Credentials, Risk Limits, Validation, Dry-run, Final Confirmation, Ready. - The user must explicitly choose MEXC, Gate.io, Coinbase, a custom comma-separated selection, or all active exchanges before live trading. - When showing Custom selection, explain that it expects comma-separated exchange IDs, for example `mexc,coinbase`, `gateio,coinbase`, or `mexc,gateio`. - API credentials must be stored locally in `~/.vara-trading-agent/.env`. - When reporting setup files to the user, show full paths such as `~/.vara-trading-agent/.env` and `~/.vara-trading-agent/onboarding.json`. - If mentioning file mode `600`, explain it as owner-only read/write permissions. - Trading API keys must have read + trade permissions only. - API withdrawals are available only as explicit opt-in high-risk actions. - Withdrawal commands currently support MEXC and Gate.io. Coinbase is active for trading/read-only order workflows, not withdrawal automation. - Live API withdrawals require dedicated withdrawal API keys, local allowlists, per-asset limits, `--mode live`, `--address-confirmed`, and `--confirm-withdrawal`. - Dry-run mode must be preferred by default. - Live trading requires explicit user instruction. - Never infer a trade from analysis or discussion. - Only execute a buy/sell command when the user explicitly asks to trade now. - Canceling an order requires an explicit order id and confirmation. - Never provide investment advice. Market data and order books are evidence, not instructions to trade. - Read `references/rivrdex-deployments.md` for known deployment addresses. Verify any override; never guess a program address. - Treat native VARA and WVARA as different assets. Before selling native VARA on RivrDEX, use the separate `dex-wrap` flow. It calls `VftNativeExchange/Mint` with attached native value using the bundled verified IDL. - Convert WVARA back to native VARA only through the separate `dex-unwrap` transaction. It calls `VftNativeExchange/BurnAll`, so it always consumes the account's full WVARA balance. Let `vara-wallet` calculate gas by default; use `--gas-limit` only as an explicit fallback. - Treat an explicitly confirmed native-VARA DEX trade as one disclosed staged workflow: wrap native input when needed, auto-approve and swap under the user's amount/slippage conditions, then unwrap WVARA output or residual WVARA back to native VARA. One user confirmation may authorize the complete non-atomic chain when every stage and the full `BurnAll` scope were disclosed in advance and the conditions do not change. Each state-changing `vara-agent` workflow command still carries its `--confirm` interlock. Read `skills/dex_trade.md` before executing any such workflow. - Use `dex-swap --mode dry-run` first. Dry-run must call quote only and must not approve, sign, or submit. - Require completed `wallet_dex` onboarding and `--confirm` for live DEX swaps. - Bind live DEX execution to the onboarded network, factory, and local wallet account. - On Vara mainnet, require at least `17 VARA` native immediately before a swap. Before wrapping `N VARA` for the full native-input workflow, require at least `N + 18 VARA`. For the verified mainnet pair, use the typed Pair call with the reviewed 150-billion gas limit by default; it can reserve `15 VARA`. Keep that limit exclusive to Pair swaps. - Derive the USD risk value from the WUSDT/WUSDC side of a fresh DEX quote. A manual `--estimated-value-usd` may increase that value but must never lower or replace it. Require the manual option only when neither side is USD-like. - Auto-approve is the default. For the verified mainnet pair, `vara-agent` must read the `.address` ActorId, clear any old allowance, approve and verify the exact quote-derived raw bound, execute the typed Pair call with 150-billion gas, and clear any remainder. `--skip-approve` is allowed only when the current allowance already equals that exact bound; cleanup remains mandatory. ## Recipe Files Read only the recipe needed for the user's request: - `skills/install_agent.md` - install and connect this skill pack. - `skills/onboarding.md` - first-time setup and exchange selection. - `skills/get_routes.md` - discover CEX and RivrDEX routes for an asset/quote pair. - `skills/check_market.md` - verify a market exists and inspect limits/precision. - `skills/get_balance.md` - fetch account balances. - `skills/get_ticker.md` - fetch ticker data. - `skills/get_orderbook.md` - fetch order book depth. - `skills/trade_guidance.md` - explain trade options, market-making style plans, risks, and dry-run next steps without giving investment advice. - `skills/get_open_orders.md` - fetch active orders. - `skills/get_orders.md` - fetch order history and status counts. - `skills/watch_orders.md` - poll order history/open orders and report fills, cancellations, and status changes. - `skills/watch_order_until_done.md` - after placing an order, track its returned order id and stop automatically when it reaches a terminal state. - `skills/cancel_order.md` - cancel an explicit order id. - `skills/buy_spot.md`, `skills/sell_spot.md` - market spot orders. - `skills/limit_buy_spot.md`, `skills/limit_sell_spot.md` - limit spot orders. - `skills/withdrawal_guide.md`, `skills/withdrawal_check.md`, `skills/withdraw_asset.md` - explicit withdrawal flow. - `skills/dex_onboarding.md` - configure RivrDEX, `vara-wallet`, and DEX risk limits. - `skills/dex_pairs.md`, `skills/dex_pool.md`, `skills/dex_quote.md` - read-only RivrDEX discovery. - `skills/dex_wrap.md` - dry-run or explicitly confirmed conversion of native VARA to WVARA. - `skills/dex_unwrap.md` - dry-run or explicitly confirmed conversion of the full WVARA balance to native VARA. - `skills/dex_trade.md` - orchestrate wrap, exact auto-approval, the verified mainnet Pair call, allowance cleanup, and final unwrap for a user-facing native VARA trade. - `skills/dex_swap.md` - dry-run or explicitly confirmed live RivrDEX swap. - `references/rivrdex-deployments.md` - known RivrDEX factory and pair addresses; read it for mainnet DEX work. ## CLI Use: ```bash vara-agent ``` ## Agent-Led Interactive Setup For first-time setup, prefer one continuous interactive session: ```bash vara-agent init-config vara-agent onboarding interactive ``` The agent should keep `vara-agent onboarding interactive` running, show the user the current prompt/options, accept the user's natural-language choice, and send the matching numeric answer to the CLI. Do not replace the interactive wizard with separate state commands such as `onboarding choose-integration` unless the user asks for non-interactive mode or the runtime cannot keep an interactive process open. When the wizard is at `Step 0 - Welcome / Risk Warning`, show the full warning text before asking the user to continue: ```text This agent can analyze spot markets and execute trades on supported CEXs and RivrDEX after setup. Crypto trading is risky. Start with dry-run or small amounts. ``` The wizard may pause at the credentials step because the user must create exchange API keys and edit `~/.vara-trading-agent/.env` locally. After the user says the keys are saved, continue the wizard from the existing state with `vara-agent onboarding interactive`. Onboarding validation must load markets and fetch balances for each selected CEX to test configured API credentials. Balance output should be presented as non-zero balances only, not raw CCXT account payloads. For `wallet_dex`, validation must check `vara-wallet >= 0.20.3`, the selected local account, and connectivity to the verified RivrDEX factory. Do not display or handle wallet secrets. Examples: ```bash vara-agent onboarding interactive vara-agent init-config vara-agent install-skills vara-agent onboarding vara-agent onboarding understand vara-agent onboarding choose-mode --mode cex_exchange vara-agent onboarding choose-integration --integration mexc vara-agent onboarding choose-integration --integration gateio vara-agent onboarding choose-integration --integration coinbase vara-agent onboarding choose-integration --integration mexc,coinbase vara-agent onboarding choose-integration --integration gateio,coinbase vara-agent onboarding choose-integration --integration all vara-agent onboarding status vara-agent routes --side buy --asset VARA --quote USDT --amount 20 vara-agent check-market --provider mexc --symbol VARA/USDT vara-agent check-market --provider mexc --symbol USDC/USDT vara-agent check-market --provider coinbase --symbol VARA/USD vara-agent balance --provider mexc vara-agent balance --provider coinbase vara-agent ticker --provider mexc --symbol VARA/USDT vara-agent ticker --provider coinbase --symbol VARA/USD vara-agent orderbook --provider mexc --symbol VARA/USDT --limit 10 vara-agent open-orders --provider mexc vara-agent orders --provider mexc vara-agent watch --orders --provider mexc --symbols VARA/USDT --interval 5m --limit 50 vara-agent watch --orders --provider mexc --symbols VARA/USDT --order-id "" --interval 30s --limit 50 vara-agent cancel-order --provider mexc --symbol VARA/USDT --order-id "" --confirm vara-agent withdrawal-guide --provider mexc --asset USDT --network TRC20 --amount 10 --address-confirmed vara-agent withdrawal-check --provider mexc --asset USDT --network TRC20 --amount 10 --address "
" vara-agent withdraw --provider mexc --asset USDT --network TRC20 --amount 10 --address "
" --mode dry-run vara-agent buy --provider mexc --symbol VARA/USDT --quote-amount 10 --mode dry-run vara-agent limit-buy --provider mexc --symbol VARA/USDT --quote-amount 2 --price 0.000605 --mode dry-run vara-agent limit-sell --provider mexc --symbol VARA/USDT --base-amount 1000 --price 0.000604 --mode dry-run vara-agent sell --provider mexc --symbol USDC/USDT --base-amount 10 --mode dry-run vara-agent sell --provider mexc --symbol VARA/USDT --base-amount 100 --mode dry-run vara-agent onboarding choose-mode --mode wallet_dex vara-agent onboarding choose-integration --integration rivrdex vara-agent dex-pairs --network mainnet vara-agent dex-pool --token0 WUSDT --token1 WVARA --network mainnet vara-agent dex-quote --token-in WUSDT --token-out WVARA --amount 10 --units human --network mainnet vara-agent dex-wrap --amount 10 --units human --network mainnet --mode dry-run vara-agent dex-unwrap --network mainnet --mode dry-run vara-agent dex-swap --token-in WUSDT --token-out WVARA --amount 10 --units human --mode dry-run --network mainnet ``` Do not use live trading unless explicitly requested. If the user says: ```text Buy VARA for 10 USDT ``` the agent may call dry-run first, or live only if the user explicitly requests live execution and the pair is allowed. If the user says: ```text Swap 10 USDC to USDT on MEXC ``` the agent should treat it as a spot sell on `USDC/USDT`, preferably dry-run first. If the user says: ```text Do you think I should buy VARA? ``` the agent must not call buy commands. ## Onboarding Before asking for any API key or wallet setup, use the wizard: 1. Welcome / Risk Warning 2. Choose mode: CEX exchange or RivrDEX wallet trading 3. Choose exchange/DEX and show integration-specific setup instructions 4. Connect credentials or configure a local encrypted wallet account 5. Configure risk limits 6. Validate setup 7. Dry-run 8. Final confirmation 9. Ready Supported active first release exchanges: - MEXC - Gate.io - Coinbase - Any comma-separated exchange combination, for example `mexc,coinbase`, `gateio,coinbase`, or `mexc,gateio` - All active exchanges - RivrDEX on Vara Network through `vara-wallet` Paper Trading, Exolix, Banxa, and Crypto.com are kept as future plans. For RivrDEX: 1. Run `vara-wallet wallet list`; create/import a dedicated limited-balance account locally when needed. 2. Read `references/rivrdex-deployments.md` and verify the listed factory before live use. 3. Store only `VARA_DEX_NETWORK`, `VARA_DEX_FACTORY`, and `VARA_DEX_ACCOUNT` in `~/.vara-trading-agent/.env`. 4. Configure `WUSDT/WVARA` and/or `WVARA/WUSDT` on mainnet. These are the tokenized aliases for the deployed VARA/USDT pair. 5. Explain that selling native VARA requires a separate `dex-wrap` transaction and that the pool returns WVARA when buying. Use `dex-unwrap` to return the full WVARA balance to native VARA. One confirmation may cover wrap, auto-approval, swap, allowance cleanup, and unwrap when the complete non-atomic chain and `BurnAll` scope are disclosed in advance; keep `--confirm` on every state-changing `vara-agent` workflow command. Use the bundled IDL; accept `--idl` only for an explicitly verified override. 6. Validate setup, then run `vara-agent onboarding dry-run`; it must automatically fetch the configured pool and a quote without selecting an account, approving, signing, or submitting. 7. Execute live only for an explicit user request using `--mode live --confirm`. For CEX trading, explain that the user must: 1. Log in to the exchange. 2. Create a dedicated API key for this agent. 3. Grant only the minimum read and trade permissions needed by that exchange. 4. Store credentials locally in `~/.vara-trading-agent/.env`. 5. Use separate withdrawal keys only if API withdrawal is explicitly enabled by the user. The agent may create `~/.vara-trading-agent/.env` and `~/.vara-trading-agent/onboarding.json` during setup. These are user-home config files, not project-local files. Do not call them just `.env` without the path. Gate.io-specific setup: - Open Security and set a Fund Password first. - It protects fund security. - Trading does not require fund password input by default. - Open API Key Management to create the Gate.io API key. - Create a dedicated API key for this agent. - Enable Read / View account data. - Enable Spot Trading. - IP whitelist is optional. - Copy the API Key and Secret Key shown by Gate.io. - Open `~/.vara-trading-agent/.env` and fill these exact lines: ```bash GATEIO_API_KEY= GATEIO_API_SECRET= ``` - Secret Key may be shown only once; never paste it into chat. - Withdrawal permission is not part of normal trading setup. API withdrawals are high risk; enable them only with a separate dedicated withdrawal key if the user explicitly wants withdrawal automation. MEXC-specific setup: - Click the account icon. - Select API Management. - Create a dedicated API key for this agent. - Enable Account Details. - Enable Trade. - Enable View Order Details. - Link IP Address is optional. - Copy the API Key / Access Key and Secret Key shown by MEXC. - Open `~/.vara-trading-agent/.env` and fill these exact lines: ```bash MEXC_API_KEY= MEXC_API_SECRET= ``` - Secret Key may be shown only once; never paste it into chat. Coinbase-specific setup: - Open Coinbase Developer Platform / Advanced Trade API key management. - Create a dedicated API key for this agent. - Scope the key to the portfolio this agent should trade from. - Enable View. - Enable Trade. - Do not enable Transfer permissions for normal trading setup. - IP whitelist is optional. - Copy the API Key name and API Secret shown by Coinbase. - Open `~/.vara-trading-agent/.env` and fill these exact lines: ```bash COINBASE_API_KEY= COINBASE_API_SECRET= ``` - Secret may be shown only once; never paste it into chat. - Coinbase withdrawal/transfer automation is not part of normal trading setup. - Coinbase VARA note: `VARA/USDC` and `VARA/USD` are useful Coinbase market examples. `VARA/USDT` was not observed during testing; always run `check-market` before adding a Coinbase pair to live risk limits. When pausing for the user to finish exchange setup, show the selected exchange field names such as `MEXC_API_KEY`, `MEXC_API_SECRET`, `GATEIO_API_KEY`, `GATEIO_API_SECRET`, `COINBASE_API_KEY`, and `COINBASE_API_SECRET`. Do not ask the user to paste key values into chat. Do not add old withdrawal-disabled wording to the MEXC or Gate.io setup checklist; withdrawal setup is a separate explicit opt-in flow. If the user chooses multiple exchanges, show each full exchange-specific setup block before asking the user to confirm the checklist. Do not replace the exchange-specific instructions with a short generic checklist. Recommend IP whitelist when a fixed IP is available, trading limits, a separate subaccount, and keeping only funds the user is willing to trade. Risk limits must list every live-tradable pair explicitly, for example `VARA/USDT,USDC/USDT` on MEXC/Gate.io or `VARA/USDC,VARA/USD` on Coinbase. The agent must not place a live order for a pair outside the configured allowed pairs. Order management commands: ```bash vara-agent open-orders --provider mexc --symbols VARA/USDT,USDC/USDT --limit 50 vara-agent orders --provider mexc --symbols VARA/USDT,USDC/USDT --limit 50 vara-agent watch --orders --provider mexc --symbols VARA/USDT,USDC/USDT --interval 5m --limit 50 vara-agent watch --orders --provider mexc --symbols VARA/USDT --order-id "" --interval 30s --limit 50 vara-agent cancel-order --provider mexc --symbol VARA/USDT --order-id "" --confirm ``` When watching an order created by a trade command, read `skills/watch_order_until_done.md` and pass its returned exchange `id` as `--order-id`. The watcher stops automatically when that tracked order becomes closed, filled, canceled, cancelled, expired, or rejected. Use `--keep-running` only if the user explicitly asks to continue polling after the tracked order is finished. Withdrawal guidance command: ```bash vara-agent withdrawal-guide --provider mexc --asset USDT --network TRC20 --amount 10 --address-confirmed vara-agent withdrawal-check --provider mexc --asset USDT --network TRC20 --amount 10 --address "
" vara-agent withdraw --provider mexc --asset USDT --network TRC20 --amount 10 --address "
" --mode dry-run ``` Live withdrawal command: ```bash vara-agent withdraw --provider mexc --asset USDT --network TRC20 --amount 10 --address "
" --mode live --address-confirmed --confirm-withdrawal ``` The agent may execute live API withdrawals only when the user explicitly asks for withdrawal now and the local config enables withdrawals with allowlisted assets, networks, addresses, and per-asset limits. For future Exolix work, keep it separate from Exchange API trading. Explain that Exolix is an instant swap provider: create swap, receive deposit address, manually send funds, receive output, track status.