🦄 Powerloom Uniswap V3 timeseries data

Autonomous Uniswap V3 monitoring on consensus-backed data. Every data point is finalized on-chain by Powerloom's decentralized sequencer-validator network (D...

This skill appears to implement the advertised Uniswap V3 monitoring and billing flows, but take care before providing secrets. Key points to consider before installing or running: - Do not reuse your main wallet private key. The repo's signup/topup scripts will sign/send on‑chain transactions using EVM_PRIVATE_KEY to recipients returned by the metering API. Use a dedicated, funded, low-value account if you must enable pay/topup flows. - If you only need read-only monitoring, prefer the documented browser/device path or only set POWERLOOM_API_KEY (the SKILL.md says that path typically only needs that key). Confirm whether your OpenClaw host actually requires the full set of env vars; if it does, consider running the scripts manually in an isolated environment instead of giving the agent a wallet key. - Inspect lib/mcp.mjs (callTool/listMcpTools) and other libs before running to confirm the exact endpoints the code will contact. The code calls the metering origin (bds-metering.powerloom.io) and MCP SSE (bds-mcp.powerloom.io) — those hosts are consistent with the homepage, but verify you trust them. - Running `npm install` will fetch dependencies from npm. If you require stronger supply-chain assurance, audit package-lock.json and the listed packages (ethers, yaml and their transitive deps). - The skill writes local state/cache under `.powerloom/*` and may create files like `~/.config/bds-agent` if you use the reference CLI. Run it in a container or isolated user account if you want to limit filesystem impact. - If you plan to use automated top-ups, review the plan/recipient details returned by GET /credits/plans before allowing any script to execute the payment step. Treat any instruction that automatically triggers signing/sending transactions as high-risk without manual confirmation. Given the sensitive powers (wallet signing) being exposed and the manifest marking the private key as required even though a read-only path exists, proceed cautiously; prefer read-only API keys and isolated test wallets, and only run payment scripts when you understand and have verified the plan/recipient details.

Type: OpenClaw Skill Name: powerloom-bds-univ3 Version: 0.0.8 The skill bundle facilitates Uniswap V3 monitoring via the Powerloom network but requires high-risk capabilities, specifically the handling of 'EVM_PRIVATE_KEY' for automated on-chain payments in 'signup-pay.mjs' and 'credits-topup.mjs'. While the code appears aligned with its stated DeFi purpose, the instructions in 'references/08-openclaw-one-shot.md' and 'SKILL.md' direct the AI agent to manage sensitive credentials and environment variables, creating a significant attack surface for credential exposure via prompt injection. No evidence of intentional exfiltration or malicious backdoors was found, but the automated wallet interaction and credential management instructions exceed the threshold for a benign classification.