问道 Agent SDK

Automates BNB Chain NFA cultivation with on-chain authorized Agent wallet for meditation, leveling, attribute allocation, PK, and breakthrough tasks.

This package is functionally consistent with an on‑chain NFA agent, but review these points before installing: - Secret handling: The agent needs the Agent private key (AGENT_PRIVATE_KEY or --key). Treat this as highly sensitive; prefer environment variable usage (AGENT_PRIVATE_KEY) over command‑line flags, and never use your main owner wallet private key. The skill metadata incorrectly lists no required env vars — assume the private key is required. - External backend: By default the agent authenticates to and uses https://wendaobsc.xyz for JWT and PK matching. The backend receives signed messages (not your private key) but will be able to authenticate your agent and coordinate PK actions. Only use the default API if you trust that service; you can set --api "" or another URL to disable/replace it. - Funding and risk: PK deposits and breakthroughs can require $JW (on‑chain token) and the agent will spend tokens from the agent wallet if present. Do not fund the agent wallet with large amounts — create a dedicated child wallet with only a small BNB balance for gas and, if you enable PK, only the minimal $JW you accept to risk. The README contains contradictory claims about whether the agent wallet holds $JW — assume PK can consume $JW from the agent wallet. - Local files: The agent persists a Merkle leaf file named .wendao-tree-<tokenId>.json in the current working directory. These files contain action logs and should be protected (permissions/backups) or periodically inspected/cleaned if you are privacy‑conscious. - Audit and provenance: The skill source lists no homepage and the registry metadata owner is opaque. If you plan to run this with real funds, consider auditing the pkg (especially execPK and execPKRecover flows that interact with the backend), running in read‑only mode first (status command), or running on a throwaway agent wallet to observe behavior before giving it any tokens. If you want, I can point out the exact lines where the agent authenticates to the backend and where wallet writes occur, or help craft safe CLI/environment settings to minimize risk.

Type: OpenClaw Skill Name: wendao-agent Version: 1.1.0 The WenDao Agent skill bundle is a legitimate automation tool for a BNB Chain-based game (BAP-578 protocol). The code (agent.ts, cli.ts) implements game-specific logic such as automated 'meditation', attribute point distribution, and 'PK' (player vs player) battles. While the tool requires a private key for an 'Agent sub-wallet', it follows security best practices by prioritizing environment variables over CLI arguments to prevent shell history exposure and uses the standard 'viem' library for secure signing. Network activity is restricted to the project's stated domain (wendaobsc.xyz) for authentication and game state resolution, with no evidence of data exfiltration, obfuscation, or malicious intent.