技能详情（站内镜像，无评论）
作者：Francesco @andreolf
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v0.1.0
统计：⭐ 1 · 1.4k · 0 current installs · 0 all-time installs
⭐ 1
安装量（当前） 0
🛡 VirusTotal ：良性 · OpenClaw ：可疑
Package：andreolf/wallet-pilot
安全扫描（ClawHub）
- VirusTotal ：良性
- OpenClaw ：可疑
OpenClaw 评估
The instructions describe a plausible wallet-automation tool, but the package is an instruction-only skill with no source, no install spec, and mismatches between claimed code/layout and the files provided — that combination and the high-impact actions (sign/send) warrant caution.
目的
The SKILL.md describes a full TypeScript/Playwright codebase and a plugin architecture (src/, adapters, example files) but the published skill contains only the SKILL.md and no code, package.json, or binaries. It also tells the user to run npm install and npm run setup even though no install spec or code files are provided. That mismatch makes it impossible to verify the implementation and is inconsistent with the claimed capabilities.
说明范围
The runtime instructions direct automated wallet actions (connect, swap, send, sign) and to create and persist a browser profile that contains a new seed-backed wallet. These actions are inherently high-risk. The instructions are also vague about exactly what the 'setup' script does, where secrets (seed phrase, private keys) will be stored, and what human confirmations are required — giving broad discretion that could lead to irreversible fund…
安装机制
No formal install spec is included (instruction-only). SKILL.md tells the user to run npm install and npx playwright install chromium, which would pull packages from npm based on a package.json that is not present in the package. That pattern shifts trust to an external, unverified codebase the user must obtain; it is not itself an automated install step in the skill bundle but it creates a practical install risk if the user follows the instru…
证书
The skill requests no environment variables or external credentials in metadata, which is proportionate. However, the functionality requires filesystem access to browser profiles and will involve private keys/seed phrases stored locally by the browser extension — the SKILL.md does not specify safe handling or encryption of those secrets. No declared env vars is not evidence of safety here because secrets live in the browser profile.
持久
The skill does not request always:true and does not declare elevated platform privileges. Autonomous model invocation is allowed by default (disable-model-invocation: false), which is normal for skills; combined with the ability to sign/send transactions this increases impact but is not itself an incoherence.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「WalletPilot」。简介：Universal browser wallet automation for AI agents. Supports 10 wallets includin…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/andreolf/wallet-pilot/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。