📦 bnbchain — BNB链交互
vv1.0.2通过 Model Context Protocol 与 BNB Chain 交互，查询区块、合约、代币、NFT、钱包、Greenfield 及 ERC-8004 代理工具，一键启动 MCP 服务器。
0· 414·1 当前·1 累计
by @0xlucasliao下载技能包
最后更新
2026/3/8
安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it says, but exercise standard caution: 1) Audit the npm package (https://github.com/bnb-chain/bnbchain-mcp) or install it locally rather than blindly running npx @bnb-chain/mcp@latest; runtime package fetches can run arbitrary code. 2) For any state-changing operation you will need to provide a PRIVATE_KEY — never paste or upload your mainnet private key to an environment you don't control. Prefer a testnet or ephemeral wallet and confirm the network before signing...详细分析 ▾
✓ 用途与能力
Name/description (BNB Chain MCP) match the runtime instructions: the SKILL.md documents read-only queries and state-changing actions on BNB/EVM networks. No unrelated credentials or unrelated binaries are requested. Requiring a private key for state-changing actions is expected for this class of skill.
ℹ 指令范围
Instructions stay within the MCP domain: how to run the MCP client via npx, which tools are read-only vs state-changing, and when PRIVATE_KEY is needed. The doc repeatedly warns not to paste keys and to use testnet. It also claims the server "does not store or log" PRIVATE_KEY — that's a developer claim you should verify by auditing the package source before supplying a key.
ℹ 安装机制
There is no registry install spec in the skill bundle; the SKILL.md tells users to run npx @bnb-chain/mcp@latest which pulls the package from npm at runtime. Fetching and executing code at runtime is a moderate risk — acceptable for developer tooling but you should audit the npm package (or install locally) before running, and consider pinning to a specific version.
✓ 凭证需求
No environment variables are required for read-only use. PRIVATE_KEY is documented as optional and only necessary for state-changing operations — this is proportional. The skill does not request unrelated secrets or multiple unrelated credentials. Users must take care to provide keys only in secure, controlled envs and preferably use testnet wallets for trials.
✓ 持久化与权限
Skill does not request persistent privileges: always:false, no install spec, and no files included. It does not attempt to modify other skills or system-wide configs. Runtime use of npx will create local npm cache artifacts as normal but the skill itself requests no persistent platform privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestvv1.0.22026/3/2
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install bnbchain
镜像加速npx clawhub@latest install bnbchain --registry https://cn.longxiaskill.com