← Back to Skills Marketplace
tezatezaz

Clawcast - Easiest Ethereum Crypto Wallet

by te_za · GitHub ↗ · v1.0.2
cross-platform ⚠ suspicious
2061
Downloads
6
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install clawcast
Description
Skill for managing EVM wallets, transactions, and network helpers via cast; covers onboarding, checks, and operating procedures.
README (SKILL.md)

Cast Skill

No high vulnerabilities found by ClawAudit AI analyse. Click to get more info

Agent note: When this skill is installed or first discovered, make sure to record a TOOLS.md entry summarizing it so the workspace cheat sheet stays up to date.

This skill is focused on crypto/EVM wallet operations and transaction workflows using cast. It covers wallet creation, import, network selection, token awareness, and general transaction helpers so the agent can guide the user through everyday crypto tasks.

Resources

  • EVM network listassets/evm-networks.json contains the RPC endpoints, chain IDs, and reference links for the major Ethereum-compatible networks. Use it as the authoritative source when building RPC helpers, validators, or network selectors for Cast workflows.
  • Token metadataassets/evm-network-tokens.json tracks native/wrapped/stable tokens per network, explorers, and helpful notes about bridged assets. Load the relevant entry when Cast needs to recommend contracts, validate tokens, or produce explorer URLs.

Scripts

  • Step scriptsscripts/01_install_cast.sh..06_finish.sh cover the onboarding flow described in the README: install Foundry/cast, create or import a key, encrypt the keystore, choose network/RPC/tokens (sourced from the JSON assets), and show the resulting address and balance. Run them in order when the user requests onboarding. Each script already prompts for the necessary inputs (mnemonic/private key, password, RPC URL, token details), so relaying the same questions to the user and then running the next script is the recommended approach.
  • Wallet health checkscripts/check_wallet.sh inspects the shared state and reports whether a keystore/address pair already exists; it returns success (0) when a wallet is present and 1 otherwise.
  • Network statusscripts/show_network.sh prints the active network name, chainId, and RPC URL from ~/.agent-wallet/state.env, or warns if the configuration is incomplete.
  • Wallet removalscripts/remove_wallet.sh safely deletes the keystore, password stash, and metadata from ~/.agent-wallet/state.env after an explicit confirmation.

Agent guidance

Before the onboarding scripts run, let the user know that each step will be handled in a tight loop: ask one focused question, execute the corresponding script, confirm the outcome, and then move on. Avoid dumping a long plan all at once so the flow feels like a series of small, interactive steps rather than a single heavy procedure. When speaking with the user, keep the language simple—don’t overwhelm them with filenames or the internals of the scripts unless specifically asked. Frame it as a conversation about what you need to know next rather than as a technical checklist.

Always ask the user, right before running each script, exactly the question that script itself will ask (password, network choice, etc.). Do not invent or fill in answers on their behalf—only use the information they explicitly provide. This keeps onboarding faithful to what they chose and avoids pushing the scripts forward with made-up data.

  1. Start with targeted help if stuck. Pipe cast --help through grep (e.g., cast --help | grep balance) to zero in on the relevant subcommand and avoid scrolling the entire manual; this saves tokens and keeps the answer focused before you proceed or explain anything.
  2. Automatic readiness check. Run scripts/check_wallet.sh automatically each session; do not ask the user to trigger it. If it detects an existing wallet, immediately display the saved address/keystore path and proceed to show the balance/network status (see next step) so the user sees “wallet ready” without extra probes.
  3. Show wallet + network status. When check_wallet finds a wallet, run scripts/show_network.sh and query the balance (e.g., cast balance \x3CADDRESS> --rpc-url \x3CRPC_URL> --ether) so the user sees the current native balance, network name, chainId, and RPC URL without being prompted to check anything manually.
  4. Onboarding flow (automatic when no wallet exists). If the readiness check exits with 1, walk through the scripted steps in order, mirroring their prompts and explicitly asking the user for every required piece of information before running the next script. After the key-material step finishes, share the derived address immediately so the user sees it before we ask them for anything in step 3:
    1. Installation — explain that the script will ensure Foundry/cast is installed so every mentioned cast command works before proceeding.
    2. Key material — before running the wallet step, ask whether they want to create a new hot keypair, import a 12/24-word MetaMask-compatible mnemonic (m/44'/60'/0'/0/0), or import a private key. Collect the chosen secret, confirm the resulting address right after the step finishes, and tell the user that address before moving on. When generating a new keypair, capture the mnemonic displayed by cast wallet new, save it to ~/.agent-wallet/mnemonic-words-\x3Ctimestamp>.txt, and tell the user the exact path plus the fact that a job (via at now + 1 hour if available or a background sleep fallback) will delete that file after 60 minutes so the seed phrase does not linger.
    3. Password — only ask for the keystore password once (there is no confirmation prompt, no save/remember question, and the account name is forced to “agent”). The script saves that password to the local helper file and uses it when creating the keystore, so nothing else is needed from the user for this step.
    4. Network — read aloud the default network list derived from assets/evm-networks.json, ask which numbered network they want, and note that the script now auto-selects the first RPC URL from that entry (it saves the matching CHAIN_ID/ETH_RPC_URL and then just shows the RPC so the user can see which endpoint is being used).
    5. Tokens — the script now prints the token table derived from assets/evm-network-tokens.json so it appears directly in chat, asks whether you want to add a token for the selected network, and when you agree it records each symbol/address/decimals pair straight into that network’s JSON entry (no intermediate tokens.tsv file is involved).
    6. Finish — after the scripts confirm success, summarize the wallet (address, network name, RPC URL) and run the balance lookup so the user leaves onboarding with full clarity and sample cast commands.
  5. Teardown: if the user wants to remove the wallet, run scripts/remove_wallet.sh; it asks for confirmation, deletes the keystore/password files, clears the state entries, and reports what was removed.

Transaction logging

Whenever you mention a transaction (history, hash, or significant transfer) to the user, append a short summary to logs/tx_mentions.log in the workspace. Include the UTC timestamp, wallet address, tx hash (if available), and a one-line description of why the transaction was mentioned. This keeps a running record for later reference.

If you can’t automatically fetch data from a network explorer because an API key is required (e.g., BscScan/Etherscan V2), tell the user that we need to fall back to manual viewing and share the direct Explorer URL (e.g., https://bscscan.com/address/\x3Caddress> or https://bscscan.com/tx/\x3CtxHash>) so they can open it themselves. Mention the limitation plainly instead of leaving them waiting for data we can’t pull.

Operator reference (common cast commands)

  1. cast balance \x3Caddress> — check the native coin balance (ETH, etc.). Common flags: --rpc-url ..., --ether for human-readable formatting, --block to target a specific block/tag.
  2. cast send — the workhorse for native transfers, ERC-20 transfers/approvals, swaps, or any signed contract interaction. Typical flags: --rpc-url ..., --keystore ..., --password-file ..., --value ..., --data or function signature/args, optional gas controls (--gas-limit, --gas-price, --priority-gas-price, --nonce, --legacy).
  3. cast call — perform read-only contract calls (balanceOf, allowance, decimals, totalSupply, etc.). Common flags: --rpc-url ..., --block ..., or --data ... when you already have calldata.
  4. cast receipt \x3CtxHash> — fetch and inspect the transaction receipt (status, gas, logs); use it to confirm success after cast send. Optional flags: --confirmations ... or requesting a single field by name.
  5. cast tx \x3CtxHash> — fetch a transaction’s details; you can request a specific field or raw RLP with --raw.
  6. cast nonce \x3Caddress> — get the current nonce to avoid "nonce too low" errors, especially when batching; optionally target a block/tag.
  7. cast rpc \x3Cmethod> [params...] — make raw JSON-RPC calls for edge cases, debug methods, or custom node features. Use --raw when passing a JSON array by string or via stdin.
  8. cast mktx ... — build and sign a raw transaction without broadcasting (prep for "prepare → review → publish"); same to/signature/args or --data, plus knobs like --value, --nonce, --gas-limit, --gas-price, --priority-gas-price.
  9. cast publish \x3CrawTx> — broadcast a signed raw transaction (pairs with mktx or any external signing flow); --async is optionally useful.
  10. cast wallet new / cast wallet new-mnemonic — generate keys or a BIP-39 mnemonic. Supply a keystore path and account name if desired; avoid --unsafe-password unless you understand the risk. Use --words/--accounts to control mnemonic length and derived accounts.
  11. cast wallet import \x3Cname> — import a private key or mnemonic into an encrypted keystore; by default it prompts for secrets, but you can pass --private-key, --mnemonic, --mnemonic-derivation-path, --mnemonic-index, --mnemonic-passphrase, or --keystore-dir.
  12. cast wallet list — show local keystore accounts; --dir points to a custom directory, and hardware flags unlock ledger/trezor lists.
  13. cast wallet address ... — derive the wallet address from a secret source (--interactive, --private-key, or --mnemonic).
  14. cast wallet sign / cast wallet verify — sign or verify messages/typed data. Provide the message and signer plus --private-key, --interactive, or --mnemonic; add --no-hash for raw hashes and --data/--from-file for EIP-712 JSON.
  15. cast parse-units \x3Camount> --decimals \x3Cn> — convert human-readable numbers (e.g., "1.5 USDC") to base units for ERC-20 transfers.
  16. cast format-units — convert base integers back into decimals given token decimals.
  17. cast to-unit / cast to-wei — ETH unit conversions; specify target unit (wei, gwei, ether, etc.) or use cast to-wei as a shortcut.
  18. cast 4byte and calldata helpers — look up a 4-byte selector and pretty-print/ decode calldata when debugging unknown transactions.
Usage Guidance
This skill is functionally coherent with a cast-based wallet helper, but there are multiple red flags you should consider before installing or running it: - The registry claims no external requirements, yet the scripts require cast/foundry, curl, python3 and optionally at/sudo. Ask the author why metadata is incomplete. Do not rely on the skill's declared requirements. - The onboarding scripts will prompt you for your mnemonic/private key and a keystore password, then save those to files in ~/.agent-wallet/pw.txt and temporary mnemonic files. These are stored in plaintext and only scheduled for deletion via 'at' (which the script may try to install). Do NOT paste real seed phrases/private keys into this tool unless you fully trust the code and runtime environment. - The installer uses curl | bash to fetch Foundry from foundry.paradigm.xyz — this executes remote code. If you decide to run it, review that installer first (do not pipe to shell blindly) or install Foundry manually from a verified source. - The remove script edits a workspace-level logs file to remove mentions of your address. That accesses files outside the skill's own directory and could modify unrelated artifacts. Review file paths and backups before running removal. - If you want to proceed safely: (1) inspect the scripts locally and run them in an isolated VM or container, (2) install Foundry/cast manually from official sources rather than allowing the script to curl|bash, (3) prefer hardware wallets or only use ephemeral test accounts (never mainnet funds) while evaluating, and (4) consider copying the scripts and adapting them to avoid storing secrets in plaintext (or using encrypted keystores only). If anything is unclear or you want, I can produce a short checklist of the exact commands and lines to review in the scripts before you run them, or produce a hardened run plan (manual install steps, required manual checks) you can follow.
Capability Analysis
Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 11 The skill is designed to manage EVM wallets using `cast`. It exhibits high-risk behaviors, including downloading and executing a remote script (`curl -L https://foundry.paradigm.xyz | bash` in `scripts/01_install_cast.sh`) to install Foundry/cast, and attempting to gain root privileges (`sudo apt-get install -y at` in `scripts/02_wallet.sh`) to install a utility for cleaning up sensitive files. While these actions are plausibly needed for the stated purpose and the `SKILL.md` instructions guide the agent towards transparency, the execution of arbitrary remote code and privilege escalation attempts without clear malicious intent classify it as suspicious due to the inherent supply chain and system modification risks.
Capability Assessment
Purpose & Capability
The skill's name/description (cast-based EVM wallet helper) matches the scripts' behavior, but the registry metadata declares no required binaries/env yet the scripts require and invoke cast/foundry, curl, python3, and optionally at/sudo. That discrepancy (declared requirements: none vs actual scripts: many) is incoherent and should have been declared.
Instruction Scope
SKILL.md instructs the agent to run the included scripts automatically (e.g., run check_wallet each session and run onboarding scripts). The scripts prompt for sensitive input (mnemonic/private key/password), write those to disk, and run remote installers. SKILL.md also promises an auto-delete fallback for mnemonics (background sleep) but the implementation only schedules deletion via 'at' (and attempts to apt-get install it), so the actual behavior doesn't fully match the instructions. The agent guidance to 'always run check_wallet automatically' grants the skill broad, repeated filesystem and network activity without explicit user consent per run.
Install Mechanism
There is no formal install spec in the registry, but the scripts themselves install Foundry by piping a remote install script (curl -L https://foundry.paradigm.xyz | bash). Download-and-execute of an external installer without verification is high-risk. The scripts also attempt to install the 'at' package via apt/sudo if missing, which can modify the host system.
Credentials
The skill declares no required environment/credentials, yet it collects highly sensitive secrets interactively (mnemonic/private key/password) and stores them in plaintext files under ~/.agent-wallet (mnemonic file, pw.txt, keystore copy, temporary private key file). It also manipulates workspace-level files when removing a wallet (attempts to remove mentions from a logs/tx_mentions.log located relative to the workspace), which reaches outside the skill's own data directory and is disproportionate for a helper.
Persistence & Privilege
The skill writes persistent files to ${HOME}/.agent-wallet and to Foundry's keystore directory and may modify PATH for the session. It does not set always:true, which is appropriate, but it will perform privileged changes (installing packages via sudo/apt) and touches workspace logs when removing a wallet. Those behaviors grant it more system reach than a minimal CLI helper and should be considered sensitive.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install clawcast
  3. After installation, invoke the skill by name or use /clawcast
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
- Added a ClawAudit security badge to the skill documentation, confirming no high vulnerabilities found by ClawAudit AI analysis. - No functional or behavioral changes to the skill itself; this update is documentation-only.
v1.0.1
No user-facing changes in this version. - Documentation (SKILL.md) was updated, but no functional or behavioral changes were made. - All guidance and workflows remain the same.
v1.0.0
Initial release of clawcast: an EVM wallet and transaction management skill using cast. - Guides users through safe EVM wallet onboarding, import, network selection, token setup, and typical transaction checks using Foundry/cast. - Onboards step-by-step with clear, non-technical prompts—no technical jargon or script/file names exposed to users. - Automatically checks for an existing wallet and displays address, network, and balance without extra user input. - Supports wallet teardown (removal) with confirmation. - Includes automatic transaction mention logging for reference. - Falls back to manual explorer URLs if network API keys are missing, explaining the limitation directly. - Uses local JSON data for networks/tokens to ensure accurate helpers and suggestions.
Metadata
Slug clawcast
Version 1.0.2
License
All-time Installs 0
Active Installs 0
Total Versions 3
Frequently Asked Questions

What is Clawcast - Easiest Ethereum Crypto Wallet?

Skill for managing EVM wallets, transactions, and network helpers via cast; covers onboarding, checks, and operating procedures. It is an AI Agent Skill for Claude Code / OpenClaw, with 2061 downloads so far.

How do I install Clawcast - Easiest Ethereum Crypto Wallet?

Run "/install clawcast" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Clawcast - Easiest Ethereum Crypto Wallet free?

Yes, Clawcast - Easiest Ethereum Crypto Wallet is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Clawcast - Easiest Ethereum Crypto Wallet support?

Clawcast - Easiest Ethereum Crypto Wallet is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Clawcast - Easiest Ethereum Crypto Wallet?

It is built and maintained by te_za (@tezatezaz); the current version is v1.0.2.

💬 Comments