技能详情（站内镜像，无评论）
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.0
统计：⭐ 1 · 1.2k · 0 current installs · 0 all-time installs
⭐ 1
安装量（当前） 0
🛡 VirusTotal ：良性 · OpenClaw ：良性
Package：asgherali/usd1
安全扫描（ClawHub）
- VirusTotal ：良性
- OpenClaw ：良性
OpenClaw 评估
The skill's code and instructions match its stated purpose (transferring USD1 via Wormhole), but there are implementation and supply-chain details you should review before use (private key handling, dependency audit, and address-format correctness).
目的
The skill name/SKILL.md describe a USD1 (Wormhole/USDC) transfer and the index.js implements a transfer using the Wormhole SDK. Required input (private key, amount, recipient) is consistent with a wallet transfer. Minor implementation issues (address format and numeric conversion) are present but do not indicate misalignment with the stated purpose.
说明范围
SKILL.md confines behavior to performing a transfer and asks for the sender private key as a secure input. The runtime code only uses provided inputs and the Wormhole SDK; it does not read other files or unrelated environment variables. Note: instructions require direct private key input (raw key material), which expands the attacker surface if mishandled.
安装机制
No install spec is provided (instruction-only), but a package.json and package-lock exist listing @wormhole-foundation/* and many third-party npm deps. There is no direct download-from-URL risk, but a dependency-heavy npm tree increases supply-chain risk and includes packages with deprecation/security notes (see guidance).
证书
No environment variables or external credentials are requested beyond the sender private key (provided as a secure input), which is proportionate for a wallet transfer. The skill does not demand unrelated secrets or system credentials.
持久
The skill does not request always:true, does not declare system-wide config changes, and appears not to persist or escalate privileges. Agent autonomous invocation remains enabled by default (platform behavior) but is not requested by the skill itself.
综合结论
This skill appears to do what it says (transfer USD1 via Wormhole) but exercise caution before installing or running it with real funds: - Private key handling: the skill requires a raw privateKey input. Avoid pasting production private keys. Prefer a signing service, ephemeral/test keys, or hardware wallet integration rather than exposing raw keys to skills. - Test first: run only on testnet and with very small amounts until you verify behavi…
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「usd1 transfer」。简介：Securely transfer USD1 (USDC on Wormhole) between wallets via Wormhole Liquidit…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/asgherali/usd1/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
# USD1 WLF Transfer Skill
## Description
Allows an agent to securely transfer USD1 (USDC on Wormhole) from one wallet to another using Wormhole Liquidity Facility (WLF).
## Capabilities
- Check sender wallet balance (optional)
- Transfer a specified amount of USD1 to a recipient address
- Return transaction hash and status
- Uses Testnet by default for safety
## Input Parameters
- amount: number (required) - amount of USD1 to send (e.g. 1.0)
- toAddress: string (required) - recipient wallet address (e.g. 0x123...)
- chain: string (optional, default: Solana) - source chain
- privateKey: string (secure, required) - sender wallet private key
## Output
- transactionHash: string
- status: "success" or "failed"
- message: string (details or error)
## Security Notes
- Never hardcode private keys
- Use secure agent input for keys
- Testnet only until production
## Example Usage
/skill usd1-wlf-transfer amount=1.0 toAddress=0xabc123... chain=Solana