Send Usdc

Send USDC to an Ethereum address or ENS name. Use when you or the user want to send money, pay someone, transfer USDC, tip, donate, or send funds to a wallet address or .eth name. Covers phrases like "send $5 to", "pay 0x...", or "transfer to vitalik.eth".

This skill is coherent for sending USDC, but it runs 'npx awal@latest' at runtime — that fetches and executes code from the npm registry each time. Before using: 1) confirm you trust the 'awal' package (check its npm/github page, maintainers, and recent releases); 2) be cautious when authenticating wallets — never paste private keys into prompts you don't trust and prefer hardware wallets or well-known wallet flows; 3) test with a very small amount first; 4) verify recipient addresses and ENS resolutions carefully before confirming a send. If you need stronger assurance, ask for the package's source URL or use a locally audited CLI instead of npx@latest.

Type: OpenClaw Skill Name: send-usdc Version: 0.1.0 The skill bundle is classified as suspicious due to the high-risk capability granted by `allowed-tools` in `SKILL.md`. It permits the AI agent to execute `npx awal@latest send *`, allowing arbitrary arguments to the `send` command. While this aligns with the skill's stated purpose of sending USDC, it represents a significant vulnerability surface for prompt injection, where a malicious prompt could trick the agent into transferring funds to an unintended recipient or amount, leading to financial loss. There is no evidence of intentional malicious code or instructions within the skill bundle itself, but the broad permission for a sensitive financial operation warrants a 'suspicious' classification.