Near Dca

Dollar-cost averaging for NEAR tokens with flexible scheduling, performance tracking, and cancellation support.

This skill appears to implement the described DCA functionality, but exercise caution before installing or providing secrets. Key points to consider: - Do not supply real private keys to the skill until you verify how the host stores them. The code accepts both config-stored and per-call private_key parameters and README examples show plaintext config values — which is insecure. - The skill's manifest does not declare required credentials even though the code uses account_id/private_key; that mismatch can lead to accidental secret placement in plaintext files. Prefer using OpenClaw's secure credential storage (or hardware wallets / read-only flows) instead of putting keys in config files. - There are inconsistent storage locations in docs and code (~/.near-dca/plans.json vs ./data/dca_state.json). Verify where state will be written on your machine and sandbox the skill (or inspect/modify paths) if you want the data in a specific secure location. - The code simulates swaps (mock price fetch and fake tx hashes) rather than performing real network calls, which is safer for review, but also means you should confirm any production-version network interactions before trusting it with funds. - The packaged test state file appears malformed/duplicated — a sign of sloppy packaging. If you proceed, run the tests in a sandboxed environment first and review the code paths that would perform real network calls or use private keys. If you need this functionality, request from the maintainer that the skill declare required credentials in its manifest, remove plaintext private_key examples from README, support secure credential retrieval, and document exactly where state and history are written.

Type: OpenClaw Skill Name: near-dca Version: 1.0.0 The skill is classified as suspicious due to its core functionality requiring direct handling of a user's blockchain private key for executing financial transactions (DCA purchases) in `actions/index.js` and `src/dca-manager.js`. While this capability is plausibly needed for the stated purpose of automating NEAR token purchases and the `README.md` advises secure storage, the direct use of such a high-value credential constitutes a significant inherent risk. There is no evidence of intentional malicious behavior like exfiltration or unauthorized use, nor any prompt injection attempts in the documentation.