技能详情（站内镜像，无评论）
作者：Wahid Shaikh @0xsoydev
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v0.1.0
统计：⭐ 0 · 380 · 1 current installs · 1 all-time installs
⭐ 0
安装量（当前） 1
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：0xsoydev/clankerkit
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill's requests and code largely match an autonomous on-chain wallet tool, but there are provenance and metadata inconsistencies plus sensitive credentials and supply-chain risks that you should understand before installing.
目的
The name/description (autonomous wallet ops) aligns with the env vars and tools (sending tokens, swaps, staking, execute_transaction). Required env vars (wallet address, policy engine address, owner address, agent private key) are reasonable for a signing agent. However, registry metadata stated no primary credential while SKILL.md declares AGENT_PRIVATE_KEY as primaryEnv — a metadata mismatch. skill.json version (0.2.0) differs from registry …
说明范围
SKILL.md and src/index.ts implement many powerful wallet operations (arbitrary contract calls, execute_transaction, pay_for_service, swap_tokens). These are consistent with the claimed purpose but grant the agent the ability to perform arbitrary on-chain actions (including arbitrary calldata and paying arbitrary endpoints). That capability is expected for a wallet skill but also makes misuse impactful.
安装机制
There is no explicit install spec, but package.json/package-lock are present and list npm dependencies (including an external 'clankerkit' package). This implies a node/npm install of third-party packages when the skill is used — a moderate supply-chain risk. No remote, untrusted archive URLs were found.
证书
The skill requires AGENT_PRIVATE_KEY in environment — appropriate for signing but highly sensitive. All required env vars are related to blockchain operation, so they are proportionate, but the presence of a private key plus autonomous invocation increases risk. Also SKILL.md/README disagree on whether AGENT_PRIVATE_KEY should include the 0x prefix; registry metadata omitted primary credential — inconsistent metadata around the most sensitive …
持久
always is false (good). disable-model-invocation is false (normal), meaning the agent can invoke autonomously; combined with the agent private key this gives a large blast radius (the skill can sign and send transactions without manual approval). This is expected for an autonomous wallet but should be explicitly accepted by the user.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「ClankerKit」。简介：Autonomous wallet operations for AI agents on Monad — swap, stake, deploy walle…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/0xsoydev/clankerkit/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。