Superior Trade Auth Agent Skill

Request and use a Superior Trade API key for https://api.superior.trade. Use when an agent needs to onboard a user by email, request an API key with POST /auth/sign-in/magic-link, set up x-api-key authentication, or recover from missing/invalid Superior Trade credentials (401/403) before backtesting or deploying a strategy.

95k tokens

context cost

the whole folder, loaded on every use

files

ships runnable scripts

copies elsewhere

how many repositories repackaged it

225

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/Superior-Trade/superior-skills --skill superior-trade-auth

The instruction itself

5 sections, as written by the author

Superior Trade Authentication

Use this skill to get a Superior Trade API key and make authenticated requests to https://api.superior.trade.

API Key Onboarding

If a user does not already have a Superior Trade API key, ask for the email address that should receive the key. Do not ask for wallet keys, seed phrases, private keys, passwords, or other secrets.

Request the key with:

curl -sS https://api.superior.trade/auth/sign-in/magic-link \
  -X POST \
  -H 'Content-Type: application/json' \
  -d '{"email":"[email protected]"}'

The API sends the key directly to the user's inbox. Tell the user to retrieve the key from their email and configure it in their normal credential store or environment, usually as SUPERIOR_TRADE_API_KEY.

Do not paste the received key into chat, source files, logs, or examples. If the user provides a key in chat, treat it as a secret and avoid repeating it.

Authenticated Requests

Use the key in the x-api-key header:

curl -sS https://api.superior.trade/v2/account \
  -H "x-api-key: $SUPERIOR_TRADE_API_KEY"

The email is verified once the API key is used successfully in an authenticated request such as the status check above. If the first authenticated request fails with 401 or 403, ask the user to confirm they copied the full key from the latest email and that the credential is being passed as the x-api-key header.

Operating Rules

Prefer SUPERIOR_TRADE_API_KEY from the environment or credential manager when it is available.
Use https://api.superior.trade as the production API base URL.
Use Content-Type: application/json for JSON request bodies.
Never fabricate authentication status. Verify by making a real API call when credentials are available.
Never request or handle private keys, seed phrases, or wallet credentials.
Never start live trading, deposits, or other fund-moving actions without the explicit confirmations required by the relevant Superior Trade trading skill.

Use the v2 skills/v2/exchanges/hyperliquid skill for Hyperliquid strategy backtests, deployments, wallets, funding, and live trading workflows.
Use the v2 skills/v2/exchanges/aerodrome skill for Aerodrome/Base spot-AMM strategy workflows.
Use the v3 skills/v3/exchanges/polymarket skill for Polymarket market discovery, backtests, deployments, and funding workflows.
Use the v3 skills/v3/exchanges/lighter skill for Lighter account bootstrap, direct CCTP deposits, fast withdrawals, and Nautilus deployments.
Use the v3 skills/v3/primitives/deposit-qr skill when a user needs a QR code or payment URI to fund a Superior-managed wallet on a specific EVM chain.
Use the skills/external-deposit skill when a user needs an external bridge/deposit UI link, Relay quote, MetaMask Mobile QR URL, or Robinhood Chain USDG bridge flow.

Other skills for the same job

different authors, same section of the catalogue

Twilio Communications

by ComeOnOliver

×2

Build communication features with Twilio: SMS messaging, voice calls, WhatsApp Business API, and user verification (2FA). Covers the full spectrum from simple notifications to complex IVR systems and multi-channel authentication. Critical focus on compliance, rate limits, and error handling. Use when: twilio, send SMS, text message, voice call, phone verification.

| Interact with Google Chat - list spaces, send messages, read conversations, and manage DMs. find a chat room, send a DM, or create a new chat space. Lightweight alternative to full Google Workspace MCP server with standalone OAuth authentication.

7k tokens scripts

Hunt Auth Bypass

by elementalsouls

Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024), partner-portal cross-IdP assertion reuse (Slack), WordPress XMLRPC bypassing SSO (Uber), JWT alg-confusion HS256/RS256 (Jitsi), JWT signature-validation skip (Linktree, Newspack), and token-audience confusion (Argo CD CVE-2023-22482). For standalone JWT signature/crypto forging (alg:none, key confusion, kid/jku) see hunt-jwt-crypto; this skill covers JWT only inside SSO/SAML/token-trust bypass chains. SAML assertion-layer attacks (XSW, comment injection, signature stripping, XXE-in-assertion) are owned by hunt-saml; this skill owns the broader cross-protocol auth-bypass taxonomy. Use when hunting auth bypass — see the Legacy-Protocol Matrix for branded-UI vs legacy-endpoint patterns.

8k tokens

Dynamic Content Personalizer

by aaron-he-zhu

Use when the user asks to "personalize the email", "add merge tags / dynamic content", "set up conditional blocks per segment", or "make first-name and product-recommendation fields fall back safely"; produces a merge-tag map with per-tag fallbacks, conditional-block rules with per-segment variations, a fallback-safety audit, and a PII guard on what may render, informing the SEND E (Engagement/personalization) dimension. Not for building the segments — use list-segment-builder; not for writing the base copy — use email-creative-builder; not for scoring EQS or running vetoes — use email-quality-auditor. 邮件个性化/合并标签/条件内容块/兜底默认值

4k tokens

Crisis Response

by indranilbanerjee

Manage PR crises. Use when: reputational threat emerges, need stakeholder messaging, or communication timeline.

794 tokens

Saas Security Posture

by BagelHole

Audit and harden your SaaS tool stack — enforce SSO, review OAuth grants, manage shadow IT, and secure admin accounts across Slack, GitHub, Google Workspace, and AWS. Use when tightening security across company SaaS tools.

3k tokens

Investigate Without Getting Made

by aiskillstore

>- Investigator OPSEC — threat-model who might notice you, control your attribution surface across IP, ASN, browser and TLS fingerprint, timing and logged-in accounts, separate research identity from real identity, build and age a sockpuppet research persona, and choose between VPN, residential proxy and Tor. Use when setting up a research account, avoiding tipping off a subject, worrying about LinkedIn profile-view leakage, needing a burner phone or email, or hardening a research VM or browser profile. Applies to covert due diligence, insider-threat investigation, source protection in journalism, and law-enforcement online work. Reference at useosint.com/skills/investigate-without-getting-made.

14k tokens