← Back to Skills Marketplace
up2itnow

Agentwallet Sdk

by up2itnow · GitHub ↗ · v1.1.0
cross-platform ⚠ suspicious
565
Downloads
0
Stars
2
Active Installs
4
Versions
Install in OpenClaw
/install agentwallet-sdk
Description
Manage on-chain spend limits for AI agents with ERC-6551 wallets, enforcing per-tx and daily token budgets, scoped operator access, and approval queues on Base.
README (SKILL.md)

Agent Wallet SDK Skill

Non-custodial wallet SDK for autonomous AI agents. Handles x402 payments, CCTP V2 cross-chain bridge transfers, ERC-8004 agent identity, and Uniswap V3 token swaps — all without holding user keys.

When to Use

Use this skill when an AI agent needs to:

  • Create or manage a non-custodial wallet (ERC-4337 smart account)
  • Make x402 HTTP payments to APIs
  • Bridge tokens cross-chain via CCTP V2 (Circle)
  • Swap tokens via Uniswap V3
  • Register or verify agent identity via ERC-8004
  • Sign transactions autonomously without custodial risk

Installation

npm install agentwallet-sdk

Current version: v2.4.1 on npm (158 tests passing, 0 compile errors)

Core Modules

WalletModule — Account Abstraction (ERC-4337)

import { AgentWallet } from 'agentwallet-sdk';

const wallet = await AgentWallet.create({
  chain: 'base',
  signer: privateKey, // Agent's own key — never custodied
});

// Send ETH
await wallet.transfer({ to: recipient, value: '0.01' });

// Get balance
const balance = await wallet.getBalance();

PaymentModule — x402 HTTP Payments

// Pay for API access automatically
const response = await wallet.x402Pay({
  url: 'https://api.example.com/data',
  maxPayment: '0.001', // ETH
});

BridgeModule — CCTP V2 Cross-Chain

// Bridge USDC from Base to Ethereum
await wallet.bridge({
  token: 'USDC',
  amount: '100',
  fromChain: 'base',
  toChain: 'ethereum',
});

SwapModule — Uniswap V3

// Swap ETH for USDC
await wallet.swap({
  tokenIn: 'ETH',
  tokenOut: 'USDC',
  amount: '0.5',
  slippage: 0.5, // 0.5%
});

IdentityModule — ERC-8004

// Register agent identity on-chain
await wallet.registerIdentity({
  name: 'MyTradingAgent',
  capabilities: ['x402-payment', 'swap', 'bridge'],
});

// Verify another agent
const verified = await wallet.verifyAgent(agentAddress);

Security Model

  • Non-custodial: Agent holds its own private key. No server stores keys
  • ERC-4337 Smart Accounts: Gas abstraction, batch transactions, session keys
  • No oracle dependencies: No external price feed reliance (prevents oracle manipulation attacks)
  • Audited: forge test suite 129/129 passing on smart contracts

Integration with Other Skills

With Mastra (AI Framework)

npm install @agent-wallet/mastra-plugin

Provides 10 Mastra tools: getBalance, transfer, swap, bridge, x402Pay, registerIdentity, verifyAgent, getTransactionHistory, estimateGas, getChainInfo.

With ClawPay MCP

npm install clawpay-mcp

Exposes wallet operations as MCP tools for any MCP-compatible agent.

Links

Usage Guidance
Do not install or use this skill in a production agent until the author/source is verified. Ask for: (1) a repository or homepage and signed release artifacts so you can inspect the actual npm package (match package name, version, and author), (2) audited smart contract addresses and the specific on-chain mechanism implementing per-tx/day spend limits and how approvals are enforced, (3) explicit instructions for secure private key handling (recommended: hardware secure enclave or platform-managed secret store) and which environment variables or RPC/API keys are required, and (4) a clear threat model describing what the agent will be allowed to sign/submit automatically. If you must test, run it in an isolated sandbox with no real funds and monitor outbound network calls and filesystem access. If you cannot obtain clear answers and source code, treat the package as untrusted.
Capability Analysis
Type: OpenClaw Skill Name: agentwallet-sdk Version: 1.1.0 The skill is classified as suspicious due to its requirement for the `exec` tool, which allows the AI agent to execute arbitrary shell commands, as specified in `skill.json`. While the `SKILL.md` only demonstrates its use for `npm install`, this capability is high-risk. Additionally, the skill's core functionality involves direct handling of `privateKey` for wallet operations, as shown in `SKILL.md`, which exposes the agent to significant security risks if the environment is compromised, even though the skill itself does not exhibit malicious intent like data exfiltration or backdoors.
Capability Tags
cryptorequires-walletcan-make-purchasescan-sign-transactions
Capability Assessment
Purpose & Capability
Metadata/description claims spend-limit enforcement, ERC-6551 wallets, scoped operators and approval queues on Base, but the included SKILL.md shows examples for ERC-4337 smart accounts, basic transfers, Uniswap/CCTP operations and x402 payments with no code or prose implementing spend limits, approval queues, or ERC-6551. Version fields disagree (registry 1.1.0, skill.json 1.0.0, SKILL.md references npm v2.4.1). Homepage/source are missing. These inconsistencies mean the skill may not do what it claims.
Instruction Scope
SKILL.md instructs installing an external npm package and shows code that expects a privateKey variable (agent-held secret) and performs payments, swaps and bridging to arbitrary endpoints/chains. There are no concrete safeguards, no declared storage or approval workflow, and no instructions for enforcing per-tx/day budgets even though the top-level description emphasizes them. The instructions therefore give broad discretion to sign and send value without specified guardrails.
Install Mechanism
This is an instruction-only skill (no install spec or code bundled), which is lower static risk, but the SKILL.md explicitly directs 'npm install agentwallet-sdk' — instructing the agent to fetch and run external code at runtime. npm is a well-known host, but the package version in the document differs from other metadata and no source/homepage repository is provided, increasing uncertainty about what will be installed.
Credentials
The skill requests no environment variables or primary credential, yet its example usage requires a private key and blockchain RPC/API access (for payments, bridging, swaps). A wallet SDK that signs transactions typically requires secrets and provider endpoints; their absence from the declared requirements is disproportionate and unexplained. That gap increases the risk of ad-hoc secret handling or insecure prompts at runtime.
Persistence & Privilege
The skill does not request 'always: true' and does not claim to modify other skills or system-wide settings. Autonomous invocation is enabled (platform default), which is expected for an operational SDK, but this combined with the other concerns increases operational risk; by itself the persistence/privilege model is acceptable.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install agentwallet-sdk
  3. After installation, invoke the skill by name or use /agentwallet-sdk
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.1.0
- Major update: switched focus from on-chain spend limits to a full-featured, non-custodial wallet SDK for AI agents. - Added support for x402 payments, CCTP V2 cross-chain bridge transfers, Uniswap V3 swaps, and ERC-8004 agent identity. - Replaced previous architecture and usage docs with new modular examples (Wallet, Payment, Bridge, Swap, Identity). - Integration instructions now included for Mastra AI framework and ClawPay MCP. - Removed documentation files related to audits, known issues, deployments, and prior skill versions for brevity. - Security and installation sections updated to match new SDK scope.
v1.0.2
Docs-only package: removed SDK source code from skill (install via npm instead). Reduces scanner false positives.
v1.0.1
Security: removed example files with private key references from skill package, declared env requirements in metadata, updated npm package name
v1.0.0
Initial release: Secure smart contract wallet for AI agents with spend limits, operator permissions, and HITL approval on Base.
Metadata
Slug agentwallet-sdk
Version 1.1.0
License
All-time Installs 2
Active Installs 2
Total Versions 4
Frequently Asked Questions

What is Agentwallet Sdk?

Manage on-chain spend limits for AI agents with ERC-6551 wallets, enforcing per-tx and daily token budgets, scoped operator access, and approval queues on Base. It is an AI Agent Skill for Claude Code / OpenClaw, with 565 downloads so far.

How do I install Agentwallet Sdk?

Run "/install agentwallet-sdk" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Agentwallet Sdk free?

Yes, Agentwallet Sdk is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Agentwallet Sdk support?

Agentwallet Sdk is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Agentwallet Sdk?

It is built and maintained by up2itnow (@up2itnow); the current version is v1.1.0.

💬 Comments