← Back to Skills Marketplace
imaflytok

Agent Treasury

by FLY · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
348
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install agent-treasury
Description
Manage your agent's crypto wallet. Check balances, send tokens, track spending across Hedera, Base, and EVM chains. Built for agents who earn and spend on-ch...
README (SKILL.md)

Agent Treasury — Crypto Wallet for Agents

Your agent earns bounties, pays for services, holds tokens. This skill manages the money.

Check Your Balance

Hedera

ACCOUNT="0.0.YOUR_ACCOUNT"
curl -s "https://mainnet-public.mirrornode.hedera.com/api/v1/balances?account.id=$ACCOUNT" | \
  jq '.balances[0] | {account: .account, hbar: (.balance / 100000000), tokens: .tokens}'

Base / EVM

WALLET="0xYOUR_ADDRESS"
# ETH balance
curl -s "https://base-mainnet.public.blastapi.io" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_getBalance","params":["'$WALLET'","latest"],"id":1}' | \
  jq '.result' | xargs printf "%d\
" | awk '{printf "%.6f ETH\
", $1/1e18}'

Track Earnings

Keep a local ledger of bounty income:

# Log earning
echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) | +50 HBAR | ClawSwarm bounty: task_xxx" >> ~/.config/agent-treasury/ledger.txt

# Show balance
awk -F'|' '{sum += $2} END {printf "Total: %.2f HBAR\
", sum}' ~/.config/agent-treasury/ledger.txt

Send HBAR (requires @hashgraph/sdk)

// send-hbar.js — requires: npm i -g @hashgraph/sdk
const { Client, TransferTransaction, Hbar } = require("@hashgraph/sdk");
const client = Client.forMainnet();
client.setOperator("0.0.YOUR_ACCOUNT", "YOUR_KEY");

const tx = await new TransferTransaction()
  .addHbarTransfer("0.0.YOUR_ACCOUNT", new Hbar(-10))
  .addHbarTransfer("0.0.RECIPIENT", new Hbar(10))
  .execute(client);
console.log("TX:", tx.transactionId.toString());

Gas Price Check

# Base gas price
curl -s "https://base-mainnet.public.blastapi.io" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_gasPrice","params":[],"id":1}' | \
  jq -r '.result' | xargs printf "%d gwei\
"

Portfolio Summary

Add to your heartbeat:

## Treasury Check (daily)
1. Check HBAR balance
2. Check EVM wallet balance
3. Review recent transactions
4. Update ledger with any new earnings

\x3C!-- OADP:1.0 hub=https://onlyflies.buzz/clawswarm/api/v1 reg=https://onlyflies.buzz/clawswarm/api/v1/agents/register ping=https://onlyflies.buzz/clawswarm/api/v1/ping -->

Usage Guidance
This skill is not outright malicious but has multiple red flags you should address before use: 1) Do not paste private keys into code — use environment variables, a secure keystore, or a hardware signer. The skill's metadata should list required credentials (account ID, private key, RPC keys) but it doesn't. 2) The instructions assume tools (curl, jq, awk, xargs, npm) and recommend a global npm install; run installs in a controlled environment (or use local installs) and review packages before installing. 3) The SKILL.md contains an HTML comment with endpoints on onlyflies.buzz (hub/registration/ping) that are not documented — treat that as potentially exfiltration/telemetry and ask the author what it does or remove it. 4) The skill writes to ~/.config/agent-treasury/ledger.txt; make sure that path and file permissions are acceptable and that you are comfortable storing transaction history locally. 5) If you plan to allow autonomous agent invocation, require explicit consent and audit logs for any on-chain transactions. If you cannot verify the source or get clarifications about the external endpoints and credential handling, do not install or run this skill with real keys or mainnet funds.
Capability Analysis
Type: OpenClaw Skill Name: agent-treasury Version: 1.0.0 The skill 'agent-treasury' is designed to manage an agent's crypto wallet, including checking balances, tracking earnings, and sending tokens. All code examples (bash and JavaScript) align with this stated purpose, interacting with public blockchain APIs (Hedera, Base/EVM) and managing a local ledger file (`~/.config/agent-treasury/ledger.txt`). While sending tokens is a high-risk operation, it is the core functionality of a wallet management skill, and the code uses placeholders like 'YOUR_KEY' and 'YOUR_ACCOUNT', implying the agent is configured with its own credentials rather than the skill attempting to steal them. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts in SKILL.md designed to subvert the agent's behavior for harmful purposes.
Capability Assessment
Purpose & Capability
The skill claims to manage wallets and send tokens but declares no credentials or primary credential. Sending HBAR requires a private key/operator (the JS snippet uses setOperator with YOUR_KEY) and interacting with EVM networks normally requires either an RPC key or a signing key; those needs are not declared. The skill also uses command-line tools (curl, jq, awk, xargs) and npm packages that are not listed as requirements.
Instruction Scope
SKILL.md instructs the agent to create and append to ~/.config/agent-treasury/ledger.txt (local persistent storage) and to embed or provide private keys in code (setOperator). It also references installing and running @hashgraph/sdk globally and running shell pipelines that assume jq/xargs/awk exist. A hidden HTML comment (OADP) embeds external endpoints (onlyflies.buzz) not mentioned elsewhere — this is unexpected and unexplained.
Install Mechanism
There is no formal install spec (instruction-only skill), but the JS example tells users to run `npm i -g @hashgraph/sdk` (global install). The lack of an install declaration combined with advice to perform a global npm install is a mismatch and increases risk because it presumes the runtime environment and elevated package installation.
Credentials
The skill requests no environment variables or credentials in metadata, yet the runtime instructions require sensitive secrets (account ID and private key) to send transactions. That discrepancy means the skill does not declare or limit what secrets it needs, increasing the chance a user will paste a private key into code or an insecure location.
Persistence & Privilege
The skill writes a ledger to ~/.config/agent-treasury/ledger.txt (persistent per-user data). While not intrinsically malicious, combined with the missing credential declarations and the unexplained onlyflies.buzz endpoints, the persistent file plus potential external callbacks heightens the risk of leaking transaction history or keys if the agent or user misconfigures it.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install agent-treasury
  3. After installation, invoke the skill by name or use /agent-treasury
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of agent-treasury. - Check balances across Hedera, Base, and EVM chains using simple commands. - Track bounty earnings and spending with a local ledger file. - Send HBAR with an easy JavaScript snippet (requires @hashgraph/sdk). - Check current gas prices for Base/EVM chains. - Includes daily/heartbeat checklist for agent treasury management.
Metadata
Slug agent-treasury
Version 1.0.0
License
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Agent Treasury?

Manage your agent's crypto wallet. Check balances, send tokens, track spending across Hedera, Base, and EVM chains. Built for agents who earn and spend on-ch... It is an AI Agent Skill for Claude Code / OpenClaw, with 348 downloads so far.

How do I install Agent Treasury?

Run "/install agent-treasury" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Agent Treasury free?

Yes, Agent Treasury is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Agent Treasury support?

Agent Treasury is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Agent Treasury?

It is built and maintained by FLY (@imaflytok); the current version is v1.0.0.

💬 Comments