技能详情（站内镜像，无评论）
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.0
统计：⭐ 0 · 1.1k · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：asgherali/usd1transaction
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill's code and instructions are internally consistent for performing a USDC transfer on Wormhole testnet, but it asks the user to supply a raw private key (highly sensitive), has no provenance (no homepage/source/author), and includes many heavy dependencies (some flagged as deprecated) that increase attack surface — so proceed with caution.
目的
The SKILL.md and index.js align: both describe transferring USD1/USDC over Wormhole Testnet and the code uses @wormhole-foundation SDK to perform a token transfer. However the registry metadata lacks a public description, homepage, or author — reducing provenance and making it harder to trust the publisher.
说明范围
The runtime instructions and code require the user's wallet privateKey as an input parameter (required). That is coherent for a transfer skill, but it means the agent runtime will receive a raw private key. SKILL.md cautions to use secure input and Testnet only, which is good, but the instructions give the agent direct access to a secret that controls funds — a significant risk if the agent environment or skill execution is compromised.
安装机制
There is no install spec (instruction-only style) but the package.json/package-lock are bundled and list @wormhole-foundation SDK dependencies and many transitive packages. No external arbitrary download URLs are used. The large dependency tree increases surface area and includes components (in package-lock) with deprecation/security notes, which should be audited before running.
证书
The skill does not request environment variables or platform credentials — instead it requires a privateKey passed at runtime. While necessary for signing a transaction, asking for a raw private key is high privilege: it grants full control of the wallet. The registry does not declare a primary credential or explain secure handling/storage of the key beyond the SKILL.md note. This is proportionate to the stated functionality but requires stron…
持久
The skill does not request always:true and does not modify system or other skills' configuration. Model invocation is allowed (default), which is normal. There is no evidence it attempts to persist credentials or change agent configuration autonomously.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「USD1 Transaction」。简介：Securely transfer USD1 (USDC on Wormhole) between wallets using Wormhole Liquid…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/asgherali/usd1transaction/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
# USD1 WLF Transfer Skill
## Description
Allows an agent to securely transfer USD1 (USDC on Wormhole) from one wallet to another using Wormhole Liquidity Facility (WLF).
## Capabilities
- Check sender wallet balance (optional)
- Transfer a specified amount of USD1 to a recipient address
- Return transaction hash and status
- Uses Testnet by default for safety
## Input Parameters
- amount: number (required) - amount of USD1 to send (e.g. 1.0)
- toAddress: string (required) - recipient wallet address (e.g. 0x123...)
- chain: string (optional, default: Solana) - source chain
- privateKey: string (secure, required) - sender wallet private key
## Output
- transactionHash: string
- status: "success" or "failed"
- message: string (details or error)
## Security Notes
- Never hardcode private keys
- Use secure agent input for keys
- Testnet only until production
## Example Usage
/skill usd1-wlf-transfer amount=1.0 toAddress=0xabc123... chain=Solana