← Back to Skills Marketplace
nathanthoreaurl

FXAI

by FlapxAgent · GitHub ↗ · v1.0.4 · MIT-0
cross-platform ⚠ suspicious
306
Downloads
2
Stars
1
Active Installs
5
Versions
Install in OpenClaw
/install fxai-skills
Description
创建 V5 代币(USDT/BNB 池子可选,0税或税收四档);支持 USDT/BNB 买入,按数量或按比例卖出到 USDT/BNB。说「FXAI」触发。依赖 BNB Chain MCP,且 MCP env 中必须配置 PRIVATE_KEY。
README (SKILL.md)

FXAI:创建代币与买卖(USDT / BNB)

当用户输入「FXAI」时触发本技能。技能通过 FlapSkill 合约支持:

  • 创建 V5 代币(创建时可选 USDT 池子BNB 池子
  • 买入目标代币(USDTBNB
  • 卖出目标代币并换回(USDTBNB
  • 按比例卖出(可换回 USDTBNB

FlapSkill 合约地址0x8f059fEb5f34031EfFA024e9EB8C9968BfFE516a
USDT(BSC)0x55d398326f99059fF775485246999027B3197955
前置要求:已配置 BNB Chain MCP 且 MCP env 中必须存在 PRIVATE_KEY,否则无法发送任何链上交易。

外部上传说明:执行 scripts/upload-token-meta.js 时,会把你提供的本地图片文件与简介、官网等元数据上传到 Flap API https://funcs.flap.sh/api/upload,用于生成创建代币所需的 _meta CID。


1. 创建代币

1.1 函数

  • createToken(...):选择创建不同的池子
  • createTokenWithQuote(..., _quoteMode):可选池子
    • _quoteMode=0 -> USDT
    • _quoteMode=1 -> BNB

1.2 规则

  • 0税:_taxRate=0,分配参数都填 0salt 用 8888。
  • 有税:_taxRate 范围 1~1000(3%=300);_mktBps + _dividendBps + _deflationBps + _lpBps = 10000salt 用 7777。
  • _dividendBps > 0_minimumShareBalance >= 10_000 ether

1.3 _meta_salt

在技能目录执行:

  • node scripts/upload-token-meta.js \x3C图片路径> "\x3C简介>" "\x3C官网>" [twitter] [telegram]
  • node scripts/find-vanity-salt.js 8888(0税)
  • node scripts/find-vanity-salt.js 7777node scripts/find-vanity-salt.js 7777 v2(有税)

注意:

  • upload-token-meta.js 会读取本地图片并上传到 https://funcs.flap.sh/api/upload
  • find-vanity-salt.js 仅在本地计算 _salt,不会上传私钥
  • 若依赖未安装,先执行 npm install

1.4 MCP 调用

write_contract

创建 USDT 池子(兼容旧流程):

  • functionName: createToken
  • args: [_name, _symbol, _meta, _feeTo, _salt, _taxRate, _mktBps, _dividendBps, _deflationBps, _lpBps, _minimumShareBalance]

创建 BNB 池子(默认)或显式选择池子:

  • functionName: createTokenWithQuote
  • args: [_name, _symbol, _meta, _feeTo, _salt, _taxRate, _mktBps, _dividendBps, _deflationBps, _lpBps, _minimumShareBalance, _quoteMode]

2. 买入

2.1 用 USDT 买入

  1. 先授权 USDT(approve_token_spending
  • tokenAddress: 0x55d398326f99059fF775485246999027B3197955
  • spenderAddress: 0x8f059fEb5f34031EfFA024e9EB8C9968BfFE516a
  • amount: 人类可读数量(如 "10"
  1. 调用:
  • functionName: buyTokensByUSDT
  • args: [_token, _usdtAmountWei]

2.2 用 BNB 买入

调用:

  • functionName: buyTokensByBNB
  • args: [_token]
  • value: BNB 数量(由交易 value 传入)

3. 卖出

3.1 按数量卖出

先授权目标代币给 FlapSkill,再调用:

  • 换 USDT:sellTokensToUSDT(_token, _tokenAmount)
  • 换 BNB:sellTokensToBNB(_token, _tokenAmount)

3.2 按比例卖出

_percentBps10000=100%5000=50%1000=10%

先授权目标代币给 FlapSkill,再调用:

  • 换 USDT:sellTokensByPercentToUSDT(_token, _percentBps)
  • 换 BNB:sellTokensByPercentToBNB(_token, _percentBps)

4. 对话示例

创建 BNB 池子:

FXAI 创建代币
名称:AAA
符号:AAA
池子:BNB
税点:3%
税收地址:0x...
营销税点:40%
持币分红税点:30%
回购销毁税点:20%
LP回流税点:10%
最低持币数量:10000

买入示例:

  • FXAI 买入 50 U 0x代币地址
  • FXAI 买入 0.2 BNB 0x代币地址

卖出示例:

  • FXAI 卖出 10000 代币 到 USDT 0x代币地址
  • FXAI 按比例卖出 30% 到 BNB 0x代币地址

5. 参考

Usage Guidance
This skill appears to implement what it claims (creating tokens and buying/selling via BNB Chain MCP), but it has two practical risks you should weigh before installing: 1) PRIVATE_KEY requirement was not declared in the registry metadata. The skill relies on the MCP environment PRIVATE_KEY to sign transactions — if you enable this skill in an environment that exposes a private key, the agent (or MCP) will be able to make arbitrary on-chain transactions with that key. Only use a key with limited funds/permissions and ensure it is stored in a secure MCP environment. 2) The included upload-token-meta.js will read a local image file you point it to and POST it to https://funcs.flap.sh/api/upload. Only upload files you intend to publish; do not pass paths to sensitive files. Verify the Flap API endpoint and the project maintainer before sending any private content. Other recommendations: - Confirm the FlapSkill contract address (0x8f05...516a) and review the provided ABI/contract code externally if possible. - Run the helper scripts locally (not in a shared/hosted agent) and inspect their behavior; find-vanity-salt runs locally and does not exfiltrate keys. - Test with a throwaway/private key and minimal funds first. - Ask the publisher to update registry metadata to declare the PRIVATE_KEY requirement and to include explicit security warnings about uploads and signing power. If you cannot verify the Flap API or contract, treat the skill as higher risk.
Capability Analysis
Type: OpenClaw Skill Name: fxai-skills Version: 1.0.4 The skill bundle requires the AI agent to execute local Node.js scripts and manage a blockchain `PRIVATE_KEY`, which are high-risk capabilities. Specifically, `scripts/upload-token-meta.js` reads a local file and uploads it to an external endpoint (https://funcs.flap.sh/api/upload); while intended for token metadata, this creates a path traversal vulnerability where a prompt injection could trick the agent into exfiltrating sensitive files (e.g., SSH keys or environment files) by passing their paths as the image argument. Although the behavior aligns with the stated purpose of token creation, the combination of local script execution and file uploading poses a significant security risk.
Capability Assessment
Purpose & Capability
The skill declares no required env vars or primary credential in the registry metadata, but both SKILL.md and README state the skill depends on the BNB Chain MCP environment variable PRIVATE_KEY to sign on-chain transactions. Requesting a chain-signing private key is consistent with the stated purpose, but the omission from declared requirements is an incoherence that can mislead users.
Instruction Scope
Runtime instructions direct users/agents to run local Node scripts: one computes CREATE2 salts locally (safe), the other reads a local image file and uploads it with metadata to the external endpoint https://funcs.flap.sh/api/upload. Uploading arbitrary local files to an external service and relying on an MCP PRIVATE_KEY to send transactions are both sensitive operations; the instructions do not explicitly warn about what kinds of local files should not be uploaded, nor do they document security boundaries for the PRIVATE_KEY.
Install Mechanism
No install spec is included (instruction-only skill plus helper scripts). The included Node scripts have straightforward, standard npm dependencies (axios, form-data, viem). No arbitrary download URLs or extract/install operations are present in the skill bundle.
Credentials
The only sensitive credential required at runtime is the MCP PRIVATE_KEY (used to sign transactions). That credential is proportionate to the skill's blockchain actions, but it is not declared in the registry metadata. The lack of explicit declared env requirements reduces transparency and is a security concern because users may not realize they must grant signing capability.
Persistence & Privilege
always is false and the skill does not request persistent/always-on privileges. However, if the agent environment (MCP) exposes PRIVATE_KEY to the skill or to the agent, the agent could autonomously sign on-chain transactions. This is expected for MCP-integrated skills but increases blast radius if PRIVATE_KEY is not tightly controlled.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install fxai-skills
  3. After installation, invoke the skill by name or use /fxai-skills
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.4
- Updated FlapSkill 合约地址为 `0x8f059fEb5f34031EfFA024e9EB8C9968BfFE516a` - 所有关联的 USDT 授权与合约调用示例中的目标地址均已更新为新合约地址 - 版本号从 1.0.2 升级为 1.0.3(SKILL.md 顶部)
v1.0.3
- No file changes detected for version 1.0.3; this release retains all features and documentation from 1.0.2. - No updates or modifications to functionality or documentation. - Existing features and usage remain unchanged.
v1.0.2
- 默认创建代币时池子类型由 USDT 改为 BNB。 - 文档(SKILL.md)说明已更新,强调默认池子及相关函数用法调整。 - 其他用法和合约接口保持不变。 - 小幅度版本号升级至 1.0.2。
v1.0.1
- Updated to version 1.0.1. - Clarified that MCP env must include PRIVATE_KEY to enable on-chain transactions. - Added detailed explanation that the token meta upload script transmits images and metadata to an external Flap API endpoint. - Improved security notes and transparency around file upload and script behavior. - Documentation refinements in SKILL.md for clarity and completeness.
v1.0.0
- Initial release of the FXAI skill (version 1.0.0). - Create V5 tokens with optional USDT or BNB pools, configurable tax (including 0-tax and four-tier tax). - Support buying tokens using USDT or BNB, and selling by quantity or percentage to USDT/BNB. - Trigger skill by saying "FXAI"; requires BNB Chain MCP and a configured PRIVATE_KEY. - Provides detailed contract addresses, function calls, and usage examples for all supported actions.
Metadata
Slug fxai-skills
Version 1.0.4
License MIT-0
All-time Installs 1
Active Installs 1
Total Versions 5
Frequently Asked Questions

What is FXAI?

创建 V5 代币(USDT/BNB 池子可选,0税或税收四档);支持 USDT/BNB 买入,按数量或按比例卖出到 USDT/BNB。说「FXAI」触发。依赖 BNB Chain MCP,且 MCP env 中必须配置 PRIVATE_KEY。 It is an AI Agent Skill for Claude Code / OpenClaw, with 306 downloads so far.

How do I install FXAI?

Run "/install fxai-skills" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is FXAI free?

Yes, FXAI is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does FXAI support?

FXAI is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created FXAI?

It is built and maintained by FlapxAgent (@nathanthoreaurl); the current version is v1.0.4.

💬 Comments