Agent-Wallet
v1.2.4Route wallet workflows for agents that need to generate or import wallets using either a seed phrase or private key. Use when the user asks for wallet creati...
1· 77·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's code and instructions are generally coherent for a local file-based wallet, but there are metadata and packaging inconsistencies (declared env vs registry metadata, missing install guidance for the viem dependency) that need clarification before use.
评估建议
This skill appears to be a legitimate local wallet tool, but there are a few things to check before installing or using it:
- Confirm the WALLET_SECRET_KEY requirement: SKILL.md and the code require WALLET_SECRET_KEY (used to encrypt/decrypt wallet material). The registry metadata showing no required env var is contradictory — ask the publisher to fix the metadata or document why it's missing.
- Ensure your environment has Node 18+ and the 'viem' dependency installed; the skill provides scripts...详细分析 ▾
✓ 用途与能力
Name/description (local wallet: generate/import/balance/sign/send) match the scripts and file-based workflows. WALLET_SECRET_KEY is logically required for encrypting/decrypting local signer material.
✓ 指令范围
SKILL.md is explicit about actions, file paths (wallet/signer.json, wallet/config.json), confirmation gates (overwrite, mainnet double confirmation), and avoids printing raw secrets. The runtime instructions limit activity to wallet generation, signing, balance checks, and sending via configured RPCs.
⚠ 安装机制
No install spec is provided even though SKILL.md declares a runtime dependency on Node >=18 and the 'viem' package. The bundle includes Node scripts but provides no guidance to ensure 'viem' is installed — this is an operational gap (not necessarily malicious) that can cause failures or unexpected behavior if the runtime differs from the developer's environment.
⚠ 凭证需求
The scripts legitimately require WALLET_SECRET_KEY (used by secret-crypto.js to derive the AES key). However, the registry metadata supplied earlier lists 'Required env vars: none' while the SKILL.md frontmatter and code require WALLET_SECRET_KEY — an inconsistency that should be resolved before trusting the skill.
✓ 持久化与权限
The skill does not request elevated privileges or permanent always: true presence. It reads/writes only its own wallet files under 'wallet/'. It does rely on the agent being able to run the included Node scripts (normal for a code-backed skill).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.42026/4/11
**Changelog for version 1.2.4:** - Security update: `reads_env_secrets` is now set to `true` (was `false`). - Send action scripts now require `--confirmMainnet=true` for mainnet broadcasts; instructions updated to reflect this. - Minor documentation adjustments on confirmation requirements for mainnet transfers.
● Pending
安装命令 点击复制
官方npx clawhub@latest install ai-agent-wallet
镜像加速npx clawhub@latest install ai-agent-wallet --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制