# Webull Orders

> Preview, inspect, place, replace, and cancel Webull Thailand stock orders with explicit safety gates. Use for a concrete user-authorized order workflow, never infer an order from research, market-data, or portfolio questions.

- **Type:** Skill
- **Install:** `agentstack add skill-nutdnuy-webull-openapi-ai-plugin-webull-orders`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [nutdnuy](https://agentstack.voostack.com/s/nutdnuy)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [nutdnuy](https://github.com/nutdnuy)
- **Source:** https://github.com/nutdnuy/webull-openapi-AI-Plugin/tree/main/skills/webull-orders

## Install

```sh
agentstack add skill-nutdnuy-webull-openapi-ai-plugin-webull-orders
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Webull orders

Read the exact endpoint entry in `references/endpoints.json`, follow its `schema_ref` into `references/openapi.json`, and read authentication rules in `references/authentication.md` before building any request. Use the official [Webull Open API reference](https://developer.webull.co.th/apis/docs/webull-open-api-reference) and current trading documentation.

## First-use onboarding

Before any order-related request, check for `WEBULL_APP_KEY` and `WEBULL_APP_SECRET` in the secure environment. If the API Key is missing, ask the user to configure it securely and stop; never request credentials in chat. Require an active `WEBULL_ACCESS_TOKEN` before preview or any order operation.

## Supported endpoints

- `POST /openapi/trade/order/preview` — preview only; gate with `PREVIEW`.
- `POST /openapi/trade/order/place` — write; require exact confirmation and `PLACE`.
- `POST /openapi/trade/order/replace` — write; require exact confirmation and `REPLACE`.
- `POST /openapi/trade/order/cancel` — write; require exact confirmation and `CANCEL`.
- `GET /openapi/trade/order/history` — read-only history.
- `GET /openapi/trade/order/open` — read-only open orders.
- `GET /openapi/trade/order/detail` — read-only detail.

All paths are documented in the [official reference index](https://developer.webull.co.th/apis/docs/webull-open-api-reference).

## Safety workflow

1. For preview, obtain the exact user-provided instrument, side, quantity, order type, price/trigger, time-in-force, account, and other catalog-required fields. Read the catalog before constructing the body, then ask for `PREVIEW` confirmation:

   ```bash
   python scripts/webull_api.py request --method POST --path /openapi/trade/order/preview --body-file ./order-preview.json --allow-write --write-confirmation PREVIEW
   ```

2. Before place, replace, or cancel, display a concise request-payload summary: environment, account (redacted), symbol, side, quantity, order type, price/trigger, time-in-force, client order id, and the exact operation. Do not execute until the user gives the corresponding exact gate: `PLACE`, `REPLACE`, or `CANCEL`.
3. Construct each body independently from `references/endpoints.json`; never copy preview output blindly into a write request and never infer missing fields. Invoke only after confirmation, using the documented method/path:

   ```bash
   python scripts/webull_api.py request --method POST --path /openapi/trade/order/place --body-file ./order-place.json --allow-write --write-confirmation PLACE
   ```

4. Treat history/open/detail as reads and redact private identifiers. Never infer a trade instruction from “analyze”, “research”, “compare”, “watch”, or “what should I buy?”
5. Surface rate-limit responses and avoid automatic retries for writes. State clearly that an accepted API request is not a guarantee of execution, fill, price, or market availability. Do not claim success until the API response confirms it.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [nutdnuy](https://github.com/nutdnuy)
- **Source:** [nutdnuy/webull-openapi-AI-Plugin](https://github.com/nutdnuy/webull-openapi-AI-Plugin)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-nutdnuy-webull-openapi-ai-plugin-webull-orders
- Seller: https://agentstack.voostack.com/s/nutdnuy
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.