メニュー
Encrypt exchange API keys and credentials stored in .security.yml using AES-256-GCM. Triggered when the user asks to encrypt their keys, secure credentials, or migrate from plaintext storage.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
Set up, manage, and automate Dollar Cost Averaging (DCA) plans. Supports buy (DCA-in) and sell (DCA-out) on any exchange, with optional indicator-gated triggers, per-plan lookback, and Settrade stock share ordering.
Fetch real-time and historical market data from configured exchanges — tickers, OHLCV candles, order books, and market catalogues.
Compute cost basis and profit/loss across exchange accounts — both unrealized (currently held) and realized (from closed trades). Use when the user asks about profit, loss, cost basis, ต้นทุน, กำไร/ขาดทุน, or returns on holdings across one or multiple portfolios.
Query exchange balances and portfolio values across configured exchange accounts — including crypto (Binance, Bitkub, OKX), Thai equities (Settrade/SET), and US equities (Webull).
Compute and interpret technical indicators (SMA, EMA, RSI, MACD, Bollinger Bands, ATR, Stochastic, VWAP) from live OHLCV data.
Place, monitor, and cancel orders on configured exchanges. Includes safety-first order lifecycle, paper trading simulation, and emergency stop.
SOC 職業分類に基づく
| name | secrets-encrypt |
| description | Encrypt exchange API keys and credentials stored in .security.yml using AES-256-GCM. Triggered when the user asks to encrypt their keys, secure credentials, or migrate from plaintext storage. |
Use this skill when the user says things like:
Credentials in .security.yml are stored as enc://<base64> blobs. Decryption requires both:
~/.ssh/khunquant_ed25519.key (generated automatically)$KHUNQUANT_HOME/.passphrase (or KHUNQUANT_KEY_PASSPHRASE env var)The encryption scheme is AES-256-GCM with HKDF-SHA256 key derivation — the open-source code does not weaken it; both the SSH key and passphrase are required to decrypt.
Warn the user that the passphrase will be stored at ~/.khunquant/.passphrase. They should also keep a copy somewhere safe — if both the passphrase file and their backup are lost, the credentials cannot be recovered.
Ask for the passphrase — remind them not to share it in public.
Confirm before running — this overwrites .security.yml.
Call config_encrypt_keys with the passphrase and rotate=false (or true if re-encrypting).
After success, tell the user:
khunquant will auto-decrypt on startup via ~/.khunquant/.passphrase.export KHUNQUANT_KEY_PASSPHRASE=<passphrase>.khunquant auth encrypt again.Encrypts all SecureString fields in .security.yml.
Parameters:
passphrase (required) — the encryption passphrase. Never echo this back to the user or include it in a visible response.rotate (optional, default false) — set to true when re-encrypting with a new passphrase.Q: What if I forget my passphrase?
There is no recovery mechanism. Keep a secure backup (password manager, etc.). You can reset by re-running khunquant onboard (which regenerates a new SSH key and passphrase) then re-entering all exchange credentials.
Q: Is it safe that the passphrase file is on disk?
The passphrase file (~/.khunquant/.passphrase, 0600) is one factor. Decryption also requires the SSH key (~/.ssh/khunquant_ed25519.key, 0600) which is a separate file. Both files together are needed to decrypt — the same security model as SSH-protected private keys.
Q: Does encryption work with the web launcher / TUI?
Yes. Any credentials entered via khunquant-launcher-tui or khunquant auth login are encrypted automatically when the passphrase is set.