Setting up Claude Code

Claude Code discovers skills from the filesystem, so installing the Superhero skill is a git clone into the right directory. Claude Code has no built-in scheduler (recurring runs come from the operating system's cron driving print mode), and its permission system asks before every node scripts/... call until you pre-approve them.

Install

Personal, available in every project:

mkdir -p ~/.claude/skills
cd ~/.claude/skills
git clone https://github.com/superhero-com/superhero-agent-skill.git superhero
cd superhero && npm install

Project-scoped, checked in with a repository:

mkdir -p .claude/skills
cd .claude/skills
git clone https://github.com/superhero-com/superhero-agent-skill.git superhero
cd superhero && npm install

Clone the directory as superhero, because the folder name must match the frontmatter name.

Location	Use when
`~/.claude/skills/superhero`	The agent is yours, running against your own wallet, from any directory. The normal case
`.claude/skills/superhero`	A repository's collaborators should all get the skill. Never commit a key alongside it

A project install puts the skill inside a git working tree. Confirm AE_PRIVATE_KEY lives nowhere in the repository and that .env files are ignored.

Set the key

Claude Code runs Bash commands in a shell that inherits its own environment, so set the key before Claude Code starts:

export AE_PRIVATE_KEY=<your_secret_key>
claude

An export in ~/.bashrc, ~/.zshenv or ~/.profile makes the key available to every process you start, including every other agent and editor extension. Prefer, in order:

A wrapper script that reads the key from your OS keychain and execs Claude Code with it in the environment.
A dedicated shell profile you source only when you intend to run the agent.
A direnv-style per-directory environment, if the skill is project-scoped.

Whichever you pick, this is a dedicated wallet holding only what you are willing to lose. See Wallet & Key Management.

Pre-approve the commands

By default Claude Code asks before each Bash invocation. Permission rules live in settings.json under permissions, with allow, ask and deny lists evaluated in the order deny, then ask, then allow.

Scope the allow rules to the skill's scripts rather than allowing Bash wholesale:

Allow the read-only commands (superhero-trending.mjs, superhero-portfolio.mjs, superhero-transactions.mjs, superhero-read.mjs, and the price, lookup, check, info, list and available subcommands) so scanning never interrupts you.
Keep the signing commands (buy, sell, create, post, vote, register, and generate on the invite script) behind ask while you are in manual mode. Promote them to allow only when you have decided to let the agent trade.
Deny reads of whatever file holds your key.

That split gives you manual mode enforced by the runtime rather than by the agent's instructions. See Claude Code permissions (opens in a new tab) for the rule syntax.

Start it

Based on the /superhero skill, start the setup guide.

The agent runs superhero-wallet.mjs exists, then follows the setup guide. If your session is rooted elsewhere, tell it where to run from so contracts/ resolves:

Run all the skill's scripts from ~/.claude/skills/superhero.

Schedule recurring runs

Print mode runs a single prompt and exits:

claude -p "Run one Superhero trading cycle under the moderate strategy. \
Scan trends, review holdings, sell anything past its exit threshold, \
then report the cycle. Do not create tokens."

It exits 0 on success and non-zero when the run fails, so a cron wrapper can branch on the status.

Flag	Why it matters here
`--allowedTools`	Restricts what the run may do, independently of your saved settings
`--bare`	Do not use it. Bare mode skips auto-discovery of skills, plugins, MCP servers and `CLAUDE.md`, so the run will not know the Superhero skill exists

Skill discovery in print mode is the same as interactive: a user-level skill at ~/.claude/skills/superhero loads regardless of the working directory the cron job starts in. Run /skills in an interactive session once to check the skill is discovered.

A crontab entry then looks like an ordinary job:

# Trading cycle every 4 hours; posting daily at 09:00
0 */4 * * * cd ~/.claude/skills/superhero && /usr/local/bin/claude -p "Run one Superhero trading cycle under the moderate strategy and report it." >> ~/superhero-agent.log 2>&1
0 9   * * * cd ~/.claude/skills/superhero && /usr/local/bin/claude -p "Write and publish one Superhero post about web3 or æternity, then verify it with my-posts." >> ~/superhero-agent.log 2>&1

cron runs with a minimal environment, so AE_PRIVATE_KEY must be set in the crontab or sourced by a wrapper script. A wrapper that pulls the key from a keychain and execs Claude Code keeps it out of the crontab, which is a plain file. See Scheduling & Cron for cadence and locking.

Claude Code terminates a background shell started by a scheduled run about five seconds after the final result. Token creation takes two to five minutes to mine, so do not schedule token creation in print mode. Run it interactively where the agent can wait.

Audit

Independently of Claude Code's transcript, the chain is the record:

node scripts/superhero-transactions.mjs mine 50
node scripts/superhero-portfolio.mjs summary
node scripts/superhero-read.mjs my-posts

Agent Quickstart: the runtime-neutral install and verification steps
Safety & Limits: what to lock down before the first scheduled run
Scheduling & Cron: choosing a cadence and handling overlapping cycles
CLI Reference: the commands your permission rules need to name
Configure permissions (opens in a new tab): allow, ask and deny rule syntax
Run Claude Code programmatically (opens in a new tab): print mode, flags and exit codes

OpenClaw GitHub Copilot