Upload Clawhub

Execute DeFi transactions on BSC via SHLL AgentNFA. The AI handles all commands and users only need to chat.

This skill legitimately needs an operator private key to execute trades, but there are worrying gaps and choices you should consider before installing: 1) Metadata mismatch: the registry claims no required env vars while the SKILL.md requires RUNNER_PRIVATE_KEY — ask the publisher to fix this and explain why it was omitted. 2) Private key handling: do NOT use a main wallet; if you proceed, create a purpose-built operator wallet with minimal BNB and never store your main funds there. Prefer ephemeral session keys where possible and avoid writing the private key to persistent agent config files (the SKILL.md examples show adding it to Claude/Cursor configs). 3) Package provenance: SKILL.md recommends npm install -g shll-skills — verify the npm package publisher and inspect the GitHub repo source before installation. 4) PolicyGuard claims to enforce safety on-chain, but execute_calldata accepts arbitrary calldata (albeit subject to on-chain checks) — understand the on-chain policy rules and verify the listed PolicyGuard contract address on BscScan. 5) If you don't fully trust the source, decline to install or use a read-only setup (monitoring functions only) until you can audit the code and confirm the private-key handling and contract behavior. If you want, I can: summarize the exact places where a private key would be persisted in your agent, draft safer onboarding steps (ephemeral key or signing-service flow), or list questions to send to the skill author for clarification.

Type: OpenClaw Skill Name: upload-clawhub Version: 6.0.5 The skill bundle provides a DeFi execution toolkit for the Binance Smart Chain (BSC) that involves high-risk capabilities, specifically the management of an operator's private key (RUNNER_PRIVATE_KEY) and the execution of arbitrary blockchain transactions via raw calldata (shll-run raw). While the documentation in SKILL.md and README.md outlines extensive security measures—such as on-chain policy enforcement (PolicyGuard), dual-wallet isolation, and mandatory user confirmation for write operations—the inherent nature of handling sensitive credentials and performing financial transactions constitutes meaningful high-risk behavior. Additionally, the instructions direct the AI agent to automatically manage its own environment variables and generate hot wallets, which increases the potential attack surface for credential exposure or session manipulation.